Verify FFmpeg downloads before install

[Blackspirits]

Summary

FFmpeg downloads are currently unpacked and installed without verifying the pinned release archive bytes.

This change:

• pins SHA-256 for the current Windows x64, macOS Intel, and macOS ARM64 FFmpeg archives
• verifies the archive before the caller can unpack it
• fails closed if a future asset URL has no pinned digest
• deletes a destination-file download when verification fails
• adds focused regression coverage, including the real download-to-verification path

Validation

• hashes verified against GitHub-published release asset digests for SubtitleEdit/support-files
• focused FFmpeg checksum regressions added
• full solution build passed
• full solution test suite passed on the first run
• validation run: #34601746674

AI assistance: ChatGPT was used to audit the download/install path, verify the GitHub-published asset digests, prepare the minimal fix, and add regression coverage.

[Blackspirits]

Independent adversarial re-review completed on head a7d2c3edad36238931aadaa0f2c01bc9b26776a9.

• Confirmed the three pinned SHA-256 values against the GitHub-published release asset digests in SubtitleEdit/support-files.
• Verified both public download paths resolve the expected digest before accepting the archive.
• The stream path cannot return successfully until checksum verification completes, so the existing view model cannot unpack tampered bytes.
• The destination-file path deletes the downloaded file on verification failure (best effort) and rethrows the integrity error.
• Unknown future asset names fail closed instead of silently skipping verification.
• Regression coverage includes the hash registry, fail-closed lookup, checksum success/mismatch, and an HTTP download-to-verification mismatch path.
• Full solution build and tests passed on first run: Actions #34601746674.

No blocker found. Keep as an internal draft; no merge or upstream proposal performed.