Verify audio.cpp runtime downloads before install

[Blackspirits]

Summary

The shared audio.cpp runtime used by IndexTTS 2.5, Higgs Audio v3, Fish Audio S2 Pro and FireRedTTS3 is downloaded by IndexTts25AudioCppDownloadService and unpacked by the TTS installer. The matching SHA-256 values already exist in DownloadHashManager, but the runtime archive was not authenticated before extraction.

This change:

• verifies every audio.cpp engine archive after download and before the installer can unpack it
• resolves the expected digest from the existing platform/backend key
• fails closed when the key or digest is missing
• rewinds the verified stream for the existing unpack/install flow
• adds regressions for the real HTTP download path and tampered archive rejection
• keeps the tests platform-aware for the architectures for which runtime archives actually exist

Validation

• no digest values were added or changed
• all seven current registry hashes were independently compared with the sha256: digests published by the official SubtitleEdit/support-files release audiocpp-indextts25-2026-09-06; all seven match
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34605523266

AI assistance: ChatGPT was used to audit the audio.cpp download/install path, compare the pinned hashes with official GitHub release asset digests, prepare the minimal integrity fix, and add regression coverage.