Verify Tesseract runtime before install

[Blackspirits]

Summary

Subtitle Edit downloads its pinned Windows Tesseract 5.5.3 runtime archive into memory, then removes the old Windows binaries and unpacks the downloaded stream. The official support-files release publishes a SHA-256 digest for that archive, but the downloaded bytes were not authenticated before the destructive install step.

This change:

• pins the SHA-256 digest for Tesseract553.zip
• verifies the runtime stream immediately after download and before old binaries can be removed
• rewinds the verified stream for the existing unpack flow
• fails closed for streams that cannot be safely verified
• leaves Tesseract language/model downloads unchanged because those use caller-provided model URLs rather than this pinned runtime archive
• adds regressions for the official digest, tampered payload rejection/rewind, and non-seekable streams

Validation

• SHA-256 independently matched the GitHub release asset digest for SubtitleEdit/support-files release tesseract553
• no Tesseract model-download behavior changed
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34634123444

Base is current upstream c38daaf93ff5b36e361619e7e336afc4b52b80c0.

AI assistance: ChatGPT was used to audit the Tesseract runtime download/install path, verify the support-files release digest, implement the minimal integrity check, and add regression coverage.