Verify Whisper engine downloads before install

[Blackspirits]

Summary

Subtitle Edit already tracks SHA-256 digests for the pinned Whisper engine archives, but the reviewed downloader fix lived on an older base. This current-base port preserves that reviewed integrity hardening exactly.

This change:

• verifies Whisper.cpp CPU/BLAS, cuBLAS and Vulkan archives against the existing platform/variant registry
• verifies Const-me Whisper and CTranslate2 archives
• verifies Purfview Faster-Whisper-XXL and WhisperX file downloads before extraction
• fails closed when a registered engine path has no key or digest
• deletes file-backed archives when integrity verification fails
• leaves generic model downloads and Silero VAD unchanged because no digest is registered for them
• carries the previously validated focused regressions unchanged

Current-base verification

• WhisperDownloadService.cs is byte-for-byte identical between old review base c694526d77d92e98e5ed1449d4dbb1925a68adac and current upstream 7dbf7e03c937241ff9511ae413d5552720249de1 (blob c479029d70d9b1f56212f285dd814c7b0831f79e)
• the previously reviewed production/test blobs were transplanted exactly onto the current upstream tree; no merge conflict or unrelated edit was introduced
• current diff is one commit / two files
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34744946210
• upstream later advanced to 5e9ae4ff332010302cc5b584ef90226518d8dc5f; the intervening commits do not touch the Whisper download/hash path

Base is upstream 7dbf7e03c937241ff9511ae413d5552720249de1.

This PR supersedes internal draft #27.

AI assistance: ChatGPT was used to independently verify exact base-file identity and transplant the already-reviewed Whisper integrity fix onto current upstream without modifying unrelated code.