Verify yt-dlp temporary downloads before install

[Blackspirits]

Summary

DownloadYtDlp downloads to the final asset name plus .part, then calls VerifyChecksumAsync before publishing the binary. The checksum lookup uses the file name as the registry key, so the temporary suffix turns a known asset into an unknown one and verification becomes a no-op.

This change:

• strips only the terminal .part suffix before checksum lookup
• preserves the existing version/asset registry, URLs, retry behavior, cleanup and atomic final move
• keeps genuinely unknown assets/versions under the existing policy
• adds a regression proving a tampered yt-dlp.exe.part is rejected and deleted instead of bypassing verification

Validation

• current upstream still calls VerifyChecksumAsync(partFileName, CurrentVersion, ...) before File.Move
• no URL, version or SHA-256 values are changed
• the production diff is five lines
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34721417793

Base is upstream fa6d8623c2adb0c646b6d31a11b221b855339bbe.

This PR supersedes internal draft #15.

AI assistance: ChatGPT was used to independently re-audit the current yt-dlp download/verification flow, isolate the temporary-name checksum bypass, port the minimal fix, and add a focused regression.

[Blackspirits]

Independent adversarial re-check on current upstream base: confirmed DownloadYtDlp still verifies the .part path before publishing, while the checksum registry is keyed by the final asset name. Stripping only the terminal .part suffix restores lookup for known assets without broadening policy for unknown versions/assets. The regression proves a tampered yt-dlp.exe.part is rejected and deleted. Full current-base CI run #34721417793 passed restore/build/full tests on the first run with no retry. No blocker identified. Keep draft; no merge/promotion performed.