Verify audio.cpp runtime downloads before install

[Blackspirits]

Summary

The shared audio.cpp runtime used by IndexTTS 2.5 and related TTS engines is downloaded and unpacked while the matching SHA-256 values already exist in DownloadHashManager. This current-base port preserves the reviewed integrity check exactly.

This change:

• verifies every audio.cpp engine archive after download and before unpack
• resolves the expected digest from the existing platform/backend key
• fails closed when the key or digest is missing
• rewinds the verified/rejected stream for the existing install flow
• carries the previously validated HTTP tamper regressions unchanged

Current-base verification

• IndexTts25AudioCppDownloadService.cs is byte-for-byte identical between old review base c694526d77d92e98e5ed1449d4dbb1925a68adac and current upstream 7dbf7e03c937241ff9511ae413d5552720249de1 (blob e8066a55edf4cd067de1769255bc78e7de8dd5b8)
• the previously reviewed production/test blobs were transplanted exactly onto the current upstream tree; no merge conflict or unrelated edit was introduced
• current diff is one commit / two files
• all seven current registry hashes were previously compared with the official SubtitleEdit/support-files release asset digests and matched
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34745109415
• upstream later advanced to 5e9ae4ff332010302cc5b584ef90226518d8dc5f; the intervening commits do not touch the audio.cpp download/hash path

Base is upstream 7dbf7e03c937241ff9511ae413d5552720249de1.

This PR supersedes internal draft #29.

AI assistance: ChatGPT was used to independently verify exact base-file identity and transplant the already-reviewed audio.cpp integrity fix onto current upstream without modifying unrelated code.