Verify libVLC downloads before unpack

[Blackspirits]

Summary

The libVLC downloader fetches pinned Windows/macOS archives that are unpacked immediately by the settings installer, but the downloaded bytes are not authenticated before extraction.

This change:

• pairs each supported libVLC archive URL with its SHA-256 digest
• verifies destination-file downloads before the installer can unpack them
• deletes file-backed downloads on download/cancellation/integrity failure
• verifies stream downloads and rewinds verified/rejected streams for existing callers
• fails closed before network access when a selected archive has no digest
• keeps URL and digest selection together for Windows x64/x86 and macOS x64
• adds regressions for all three platform mappings, tampered cleanup, valid file preservation, missing-digest fail-closed behavior, stream rewind and non-seekable streams

Validation

• Windows x64 SHA-256 independently matched the checksum displayed by VideoLAN for vlc-3.0.23-win64.7z: eb4fd8a28291da73608c733786a09610fea865fbe94113bcb60b91c1ebb8404a
• Windows x86 SHA-256 independently matched the checksum displayed by VideoLAN for vlc-3.0.23-win32.7z: f148ff49cdac6c0b6b7018ad7c4e6cd24c99bc6c2dea8258d82684261a639017
• macOS x64 SHA-256 independently matched the GitHub release asset digest for SubtitleEdit/support-files release vlc3: 301c3c4a78ae2339d075f557af7ab0006c427dbd3e903c4778c59de9684c353a
• the current installer only extracts after the verified download task completes successfully
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34706868169

Base is upstream 9be10e12d0f04655f2f134718b00679f89b2b15f.

This PR supersedes internal draft #34.

AI assistance: ChatGPT was used to independently re-audit the libVLC download/unpack path on current upstream, reconfirm the official/published archive digests, strengthen fail-closed behavior, port the integrity fix, and add regression coverage.

[Blackspirits]

Independent adversarial re-check on current upstream base: reconfirmed the Windows x64/x86 VideoLAN archive checksums and the macOS x64 support-files digest; URL/digest selection is paired per supported architecture, missing digests fail before network access, tampered file downloads are deleted, streams are rewound, and the installer only extracts after the verified task succeeds. Full current-base CI run #34706868169 passed on the first test run with no retry. No blocker identified. Keep draft; no merge/promotion performed.

[Blackspirits]

Independent adversarial re-check on current upstream base: reconfirmed the two VideoLAN Windows checksums and the macOS SubtitleEdit/support-files digest; file-backed downloads fail closed before HTTP if a digest is missing, tampered files are deleted, verified files are preserved, stream verification rewinds, and the installer only unpacks after the verified task succeeds. Full current-base CI run #34706868169 passed on the first test run with no retry. No blocker identified. Keep draft; no merge/promotion performed.

[Blackspirits]

Independent adversarial re-check on current upstream base: reconfirmed the Windows x64/x86 VideoLAN checksums and the macOS x64 SubtitleEdit/support-files digest; the installer extracts only after verified download success; missing digest fails before network access, tampered file downloads are deleted, streams are rewound, and unsupported/non-seekable cases fail closed. Full current-base CI run #34706868169 passed on the first test run with no retry. No blocker identified. Keep draft; no merge/promotion performed.

[Blackspirits]

Independent adversarial re-check on current upstream base: reconfirmed the Windows x64/x86 VideoLAN archive digests and the macOS x64 support-files digest; file-backed downloads now fail closed before HTTP when the digest is missing, delete failed/tampered downloads, preserve valid downloads, and stream-backed downloads reject tampered/non-seekable content before unpack. Full current-base CI run #34706868169 passed on the first test run with no retry. No blocker identified. Keep draft; no merge/promotion performed.