Verify Paddle OCR downloads before unpack

[Blackspirits]

Summary

Paddle OCR standalone engines and bundled OCR models are downloaded to a temporary folder and unpacked after only existence/non-empty checks. The upstream timminator/PaddleOCR-Standalone v3.7.0 release publishes SHA-256 digests for every asset Subtitle Edit downloads, including both volumes of the Linux CUDA 12 archive.

This change:

• pins each Paddle OCR download URL together with its official SHA-256 digest
• verifies every downloaded asset before the task is considered successful
• deletes the downloaded file on mismatch or verification failure
• fails closed before network access when an asset has no pinned digest
• verifies both volumes independently before a multipart archive can reach extraction
• preserves the existing URL list compatibility and unpack/root-folder behavior
• covers the bundled PP-OCRv6 models archive as well as all Windows/Linux CPU/CUDA engine archives
• adds regressions for all 8 official asset digests, tampered payload rejection/cleanup, a matching payload, and missing-digest fail-closed behavior

Validation

• the eight pinned SHA-256 values were independently read from the official GitHub release asset metadata for timminator/PaddleOCR-Standalone v3.7.0
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34628810666

Base is upstream 10b4b012fdb1e31edbff09ab69370c1c50ed9374. Upstream later advanced to c38daaf93ff5b36e361619e7e336afc4b52b80c0; those intervening commits only change Voikko/build packaging and do not touch Paddle OCR or the integrity path.

AI assistance: ChatGPT was used to audit the Paddle OCR download/unpack flow, verify official GitHub release digests, implement per-asset integrity checks including multipart archives, and add regression coverage.