Verify Whisper engine downloads before install

[Blackspirits]

Summary

Subtitle Edit already tracks current SHA-256 digests for the pinned Whisper engine archives in DownloadHashManager, but WhisperDownloadService downloaded those archives and returned them to the unpack/install flow without authenticating the bytes.

This change:

• verifies Whisper.cpp CPU/BLAS, cuBLAS and Vulkan archives against the existing platform/variant registry
• verifies Const-me Whisper and CTranslate2 archives
• verifies Purfview Faster-Whisper-XXL and WhisperX file downloads before extraction
• fails closed when a registered engine path has no key or digest
• deletes file-backed archives when integrity verification fails
• leaves generic model downloads and Silero VAD unchanged because no digest is currently registered for them
• adds regressions for the real HTTP download path, unknown keys, and tampered file cleanup

Validation

• no new digest values introduced; the change reuses the existing current hashes and resolvers in DownloadHashManager
• focused Whisper integrity regressions added
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34604247818

AI assistance: ChatGPT was used to audit the Whisper download/install paths, prepare the minimal integrity fix, and add regression coverage.