Verify libmpv downloads before install

[Blackspirits]

Summary

The Windows libmpv runtime downloader fetches pinned ZIP archives and the UI unpacks them immediately after a successful download, but the archive bytes were not authenticated.

This change:

• pins the GitHub-published SHA-256 digests for the current x64 and ARM64 libmpv archives
• verifies the archive before a successful download task can return to the unpacking UI
• fails closed if a future asset URL has no pinned digest
• deletes a destination-file download when verification fails
• adds focused regression coverage, including the HTTP download-to-verification path

The digests match the same libmpv-2026-08-14b assets independently verified for internal PR #23's release-workflow hardening.

Validation

• both SHA-256 values verified against GitHub release asset metadata for SubtitleEdit/support-files
• focused libmpv checksum regressions added
• full solution build passed
• full solution test suite passed on the first run
• validation run: #34602337732

AI assistance: ChatGPT was used to audit the runtime download/unpack path, verify release asset digests, prepare the minimal fix, and add regression coverage.

[Blackspirits]

Independent adversarial re-review completed on head 8f32dc292b640979c91081de54b409097813a8a2.

• Confirmed both pinned digests against GitHub release metadata for SubtitleEdit/support-files release libmpv-2026-08-14b.
• Confirmed the existing UI only unpacks the in-memory archive when the download task completes successfully; checksum mismatch now faults that task before extraction.
• Both stream and destination-file download APIs verify bytes; the file path removes the rejected download best-effort.
• Unknown future asset filenames fail closed instead of bypassing verification.
• Regression coverage checks both known asset mappings, digest shape, fail-closed lookup, a canonical SHA-256 vector, and an HTTP download-to-verification mismatch.
• Full solution build and tests passed on first run: Actions #34602337732.

One test-vector typo was found and corrected before this PR was opened; it is not present in this head.

No blocker found. Keep as an internal draft; no merge or upstream proposal performed.