Verify Piper runtime downloads before install

[Blackspirits]

Summary

The Piper runtime archive is downloaded by TtsDownloadService and unpacked by the TTS installer, while the pinned archive hashes already exist in DownloadHashManager. The downloaded bytes were not authenticated before extraction.

This change:

• verifies the Piper runtime archive against DownloadHashManager.ResolvePiperKey() before the install flow can unpack it
• fails closed when the platform key or current digest is missing
• rewinds verified streams for the existing unpack flow
• verifies and removes file-backed downloads on mismatch
• uses one platform URL resolver for both Piper download overloads, so the file overload no longer falls back to the macOS archive on Linux
• adds regressions for the real HTTP stream path, tampered streams, and tampered file cleanup

Validation

• no new digest values introduced; existing Piper hashes in DownloadHashManager are reused
• the pinned URLs still target the official rhasspy/piper 2023.11.14-2 release assets
• GitHub's release API reports no asset digest for this older release, so no independent upstream-digest claim is made here
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34604867023

AI assistance: ChatGPT was used to audit the Piper download/install path, prepare the minimal integrity fix, and add regression coverage.