Verify Google Lens OCR downloads before unpack

[Blackspirits]

Summary

The Google Lens OCR standalone downloader fetches pinned Windows/Linux release archives that are unpacked immediately by the OCR installer, but the downloaded bytes were not authenticated.

This change:

• pairs the Windows and Linux v3.4.0 archive URLs with their official SHA-256 digests
• verifies destination-file downloads before the installer can unpack them
• deletes file-backed downloads on download/verification failure
• verifies stream downloads and rewinds verified streams for existing callers
• preserves the existing Linux ARM64 unsupported behavior
• adds regressions for both platform mappings, ARM64 rejection, tampered file cleanup, and stream rewind after rejection

Validation

• Windows SHA-256 independently matched the GitHub release asset digest for timminator/Chrome-Lens-OCR v3.4.0
• Linux SHA-256 independently matched the GitHub release asset digest for the same release
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34634020745

Base is current upstream c38daaf93ff5b36e361619e7e336afc4b52b80c0.

AI assistance: ChatGPT was used to audit the Google Lens OCR download/unpack path, verify the official GitHub release digests, implement integrity checks, and add regression coverage.