Fail closed on unknown Kokoro TTS runtime hashes

[Blackspirits]

Summary

The Kokoro TTS runtime archive is already checked against DownloadHashManager, but its integrity helper currently returns without verification when the platform key/digest cannot be resolved or when the stream is empty. That can turn a future resolver/registry mismatch into an unauthenticated unpack.

This change:

• fails closed when the Kokoro TTS runtime hash key is missing
• fails closed when the current digest is missing
• rejects empty/tampered payloads instead of treating an empty stream as verified
• rejects streams that cannot be safely read and rewound
• always rewinds the stream after hashing, including failure/cancellation paths
• preserves the existing runtime URLs, release pin, registered digests, model-download behavior and unpack flow
• adds regressions for all four current runtime digests, the real HTTP engine path, null/unknown keys, empty streams and non-seekable streams

Validation

• no URL or digest values were changed
• all four current runtime registry hashes were independently compared with the sha256: asset digests published by the official niksedk/kokoro.cpp release v0.1.2; all four match
• the current caller only unpacks the runtime after the download task completes successfully
• Kokoro model publication/integrity remains intentionally separate in internal PR Verify Kokoro model downloads before publish #37
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34705356330

Base is upstream 9be10e12d0f04655f2f134718b00679f89b2b15f.

This PR supersedes internal draft #46.

AI assistance: ChatGPT was used to independently re-audit the Kokoro TTS runtime integrity/unpack path on current upstream, compare current registry hashes with official release asset digests, strengthen fail-closed verification, and add regression coverage.

[Blackspirits]

Independent adversarial re-check on current upstream base: confirmed all four Kokoro TTS runtime hashes against the official niksedk/kokoro.cpp v0.1.2 release asset digests; the caller only unpacks after the verified task succeeds; null/unknown keys, empty streams, non-seekable streams and tampered bytes now fail closed. Full current-base CI run #34705356330 passed on the first test run with no retry. No blocker identified. Keep draft; no merge/promotion performed.