Verify Kokoro model downloads before publish

[Blackspirits]

Summary

Kokoro TTS downloads two pinned model assets directly into their final file names. The upstream koth/kokoro.cpp voices_model_files release publishes SHA-256 digests for both assets, but the downloaded bytes were not authenticated. A failed/partial direct-to-final download could also leave a file that later existence checks treated as installed.

This change:

• pins the official SHA-256 digests for kokoro-v1.1-zh.onnx and voices-v1.1-zh.bin
• downloads each model to a .part file
• verifies SHA-256 before publishing the model
• atomically moves only verified bytes into the final path
• removes temporary files on download or integrity failure
• fails closed before network access when a digest is missing
• leaves the already-verified Kokoro engine archive path unchanged
• adds regressions for both official digests, valid atomic publish, tampered payload cleanup, and missing-digest fail-closed behavior

Validation

• kokoro-v1.1-zh.onnx SHA-256 independently matched the GitHub release asset digest: eefec708cbc7aba8e8129b5c2f7cb92e1fe7d281af1e1dd451592d9ff0714a0d
• voices-v1.1-zh.bin SHA-256 independently matched the GitHub release asset digest: e678019845e6cfe3b7c34531779396b28f509451b91e6535d5dc09bbf11a4be5
• full solution CI pending

Base is current upstream c38daaf93ff5b36e361619e7e336afc4b52b80c0.

AI assistance: ChatGPT was used to audit the Kokoro model download/install path, verify official GitHub release digests, add atomic verified publication, and add regression coverage.