Verify Qwen3 ASR engine downloads

[Blackspirits]

Summary

Qwen3 ASR already maintains current and historical archive hashes in DownloadHashManager, but Qwen3AsrCppDownloadService.DownloadEngine did not verify the downloaded archive before the caller unpacked it.

This change:

• verifies every Qwen3 ASR engine archive against the existing platform/variant hash key
• fails closed when the resolver or hash registry has no digest
• rewinds the verified stream for the existing unpack/install flow
• adds regression coverage for all seven current v0.1.8 archive digests and a tampered HTTP payload

Validation

• all seven current hashes independently matched against GitHub release asset digests for niksedk/qwen3-asr.cpp v0.1.8
• focused Qwen3 ASR integrity regressions added
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34602961449

AI assistance: ChatGPT was used to audit the download/install path, independently verify current release digests, prepare the minimal fix, and add regression coverage.