Verify Crisp ASR runtime downloads before install

[Blackspirits]

Summary

Crisp ASR runtime archives are downloaded and unpacked by the speech-to-text installer while their SHA-256 values already exist in DownloadHashManager. This current-base port preserves the reviewed integrity fix exactly.

This change:

• pairs each Crisp ASR runtime URL with its exact existing archive hash key
• verifies downloaded bytes before the installer can write the install sidecar or unpack them
• covers Windows CUDA/CUDA 13/Vulkan/CPU/CPU legacy, Linux CUDA/CUDA 13/Vulkan/HIP/default x64/ARM64, and macOS ARM64/Intel
• fails closed when a hash key or digest is missing
• rewinds the verified/rejected stream for the existing flow
• carries the previously validated digest and tamper regressions unchanged

Current-base verification

• CrispAsrDownloadService.cs is byte-for-byte identical between old review base b9271b925ceb714cff6675c247210b53c4002224 and current upstream 7dbf7e03c937241ff9511ae413d5552720249de1 (blob 10298a7313b4dead594561294015a4cf47e1a6cb)
• the previously reviewed production/test blobs were transplanted exactly onto the current upstream tree; no merge conflict or unrelated edit was introduced
• current diff is one commit / two files
• all 13 archive hashes were previously independently verified against the official release asset digests
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34745148074
• upstream later advanced to 5e9ae4ff332010302cc5b584ef90226518d8dc5f; the intervening commits do not touch the Crisp ASR download/hash path

Base is upstream 7dbf7e03c937241ff9511ae413d5552720249de1.

This PR supersedes internal draft #30.

AI assistance: ChatGPT was used to independently verify exact base-file identity and transplant the already-reviewed Crisp ASR integrity fix onto current upstream without modifying unrelated code.