Verify Piper runtime downloads before install

[Blackspirits]

Summary

The Piper runtime archive is downloaded and unpacked by the TTS installer while its pinned hashes already exist in DownloadHashManager. This current-base port preserves the reviewed integrity fix exactly.

This change:

• verifies the Piper runtime archive against the existing platform hash key before unpack
• fails closed when the platform key or current digest is missing
• rewinds verified/rejected streams for the existing flow
• verifies and removes file-backed downloads on mismatch
• uses one platform URL resolver for both overloads, preserving the Linux fix from the reviewed PR
• carries the focused tampered-stream/file regressions unchanged

Current-base verification

• TtsDownloadService.cs is byte-for-byte identical between old review base c694526d77d92e98e5ed1449d4dbb1925a68adac and current upstream 7dbf7e03c937241ff9511ae413d5552720249de1 (blob d75452be05517896bcc599d33c2008c446b33e8f)
• the previously reviewed production/test blobs were transplanted exactly onto the current upstream tree; no merge conflict or unrelated edit was introduced
• current diff is one commit / two files
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34745060868
• upstream later advanced to 5e9ae4ff332010302cc5b584ef90226518d8dc5f; the intervening commits do not touch the Piper download/hash path

Base is upstream 7dbf7e03c937241ff9511ae413d5552720249de1.

This PR supersedes internal draft #28.

AI assistance: ChatGPT was used to independently verify exact base-file identity and transplant the already-reviewed Piper integrity fix onto current upstream without modifying unrelated code.