Verify Google Lens OCR downloads before unpack

[Blackspirits]

Summary

The Google Lens OCR standalone downloader fetches pinned Windows/Linux release archives that are unpacked immediately by the OCR installer, but the downloaded bytes are not authenticated before extraction.

This change:

• pairs the Windows and Linux v3.4.0 archive URLs with their official SHA-256 digests
• verifies destination-file downloads before the installer can unpack them
• deletes file-backed downloads on download/cancellation/integrity failure
• verifies stream downloads and rewinds verified/rejected streams for existing callers
• fails closed before network access when a selected archive has no digest
• preserves the existing Linux ARM64 unsupported behavior
• adds regressions for both platform mappings, ARM64 rejection, tampered cleanup, valid file preservation, missing-digest fail-closed behavior, stream rewind and non-seekable streams

Validation

• Windows SHA-256 independently matched the GitHub release asset digest for timminator/Chrome-Lens-OCR v3.4.0: 201685c3a3857515360174ab1e470c0f6d1e35fd90ece76deb74c277d17df085
• Linux SHA-256 independently matched the same release asset digest: 661348e20c12e4e43df061189bb90c46eff07ec25835532c52f6dcb1ce9d6d42
• the current installer only extracts after the verified download task completes successfully
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34720904188

Base is upstream fa6d8623c2adb0c646b6d31a11b221b855339bbe.

This PR supersedes internal drafts #35 and #58.

AI assistance: ChatGPT was used to independently re-audit the Google Lens OCR download/unpack path on current upstream, reconfirm official GitHub release digests, strengthen fail-closed behavior, port the integrity fix, and add regression coverage.

[Blackspirits]

Independent adversarial re-check on current upstream base: reconfirmed both Chrome-Lens-OCR v3.4.0 asset digests, preserved Linux ARM64 rejection, paired URL/digest selection per platform, made missing digests fail before HTTP, and verified tampered downloads cannot reach extraction. Full CI run #34720904188 passed on the first test run with no retry. No comments, reviews, or unresolved threads were pending. No blocker identified. Keep draft; no merge/promotion performed.