Verify Crisp ASR runtime downloads before install

[Blackspirits]

Summary

Crisp ASR runtime archives are downloaded by CrispAsrDownloadService and unpacked immediately by the speech-to-text installer. The matching SHA-256 values already exist in DownloadHashManager, but the downloaded archive bytes were not authenticated before extraction.

This change:

• pairs each Crisp ASR download URL with its exact existing archive hash key
• verifies the downloaded stream before the installer can write the install sidecar or unpack it
• covers Windows CUDA/CUDA 13/Vulkan/CPU/CPU legacy, Linux CUDA/CUDA 13/Vulkan/HIP/default x64/ARM64, and macOS ARM64/Intel
• fails closed when a hash key or digest is missing
• rewinds the verified stream for the existing sidecar/unpack flow
• adds regression coverage for all 13 current archive digests, the real HTTP download path, unknown-key fail-closed behavior, and stream rewind after rejection

Validation

• no digest values were added or changed
• all 12 upstream CrispASR v0.8.32 archive hashes used by Subtitle Edit were independently compared with the sha256: digests published by CrispStrobe/CrispASR; all match
• the Intel macOS archive hash was independently compared with the sha256: digest published by SubtitleEdit/support-files release crispasr-0832-macos-x64; it matches
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34627661531

Base is upstream b9271b925ceb714cff6675c247210b53c4002224. Upstream later advanced to 10b4b012fdb1e31edbff09ab69370c1c50ed9374; those intervening commits do not touch the Crisp ASR download/hash path.

AI assistance: ChatGPT was used to audit the Crisp ASR download/install paths, compare the pinned hashes with official GitHub release asset digests, prepare the minimal integrity fix, and add regression coverage.