Verify Tesseract runtime before install

[Blackspirits]

Summary

The pinned Windows Tesseract runtime archive is downloaded into memory and, after the task succeeds, the installer removes the previous Windows binaries before unpacking the new runtime. The official support-files release publishes a SHA-256 digest, but the downloaded bytes are not authenticated before that destructive install step.

This change:

• pins the official SHA-256 for Tesseract553.zip
• verifies the runtime immediately after download and before the caller can remove old binaries or unpack
• rewinds verified/rejected streams for the existing unpack flow
• fails closed for streams that cannot be safely verified
• keeps Tesseract language/model downloads unchanged because those use caller-provided model URLs rather than this pinned runtime archive
• adds regression coverage for the official digest, the real download→verify helper path, tampered rejection/rewind, and non-seekable streams

Validation

• SHA-256 independently matched the GitHub release asset digest for SubtitleEdit/support-files release tesseract553: fef2dbb1de8f25d660301c17aff107c0d9b0dc99e0d4f0eee938eb7238d7d2dc
• current UI calls RemoveOldWindowsBinaries() only after DownloadTesseract completes successfully, so integrity failure blocks the destructive step
• no Tesseract model-download behavior changed
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34707410982

Base is upstream 9be10e12d0f04655f2f134718b00679f89b2b15f.

This PR supersedes internal draft #36.

AI assistance: ChatGPT was used to independently re-audit the Tesseract runtime download/install sequence on current upstream, reconfirm the support-files release digest, port the minimal integrity fix, and add regression coverage.

[Blackspirits]

Independent adversarial re-check on current upstream base: reconfirmed the pinned Tesseract553.zip digest against the official SubtitleEdit/support-files release, verified that the UI removes old Windows binaries only after the verified download task completes, and confirmed model downloads remain out of scope. Tampered and non-seekable runtime streams fail before the destructive install step. Full current-base CI run #34707410982 passed on the first test run with no retry. No blocker identified. Keep draft; no merge/promotion performed.