[github-actions]

Issue: Refs #321

What

• Plan now carries WantChecksum, the SHA-256 digest verified at download time.
• Apply re-verifies the artifact bytes at install time and aborts on mismatch, for both the package-manager and self-replace paths.
• Apply also refuses any plan that carries no verified digest.
• Regression tests cover the tampered-artifact and missing-digest cases.

Why

• The artifact's checksum was verified once at download time, but nothing guaranteed the file on disk was still the verified bytes by the time it was installed. Re-verification at install time closes that security gap.

How

• Check records the digest that passed verification in Plan.WantChecksum (internal/updater/updater.go).
• The package-manager path re-reads and hashes the file right before handing it to the installer; the self-replace path hashes the archive through the same reader that unpacks it, so the digest always covers the exact bytes being installed (internal/updater/updater.go).

Verification

• go build ./..., go vet ./..., gofmt -l ., and staticcheck ./... pass.
• The security regression tests in internal/updater/download_tamper_security_test.go pass, along with the full updater test suite (go test ./internal/updater/...).

Follow-up

• None.