security: fail-closed binary checksum verification + version-tag validation

[rafaelfiguereod-stack]

Summary

Two small, self-contained, backward-compatible hardening changes to the binary supply chain (Python + TS clients), with new tests.

1. Checksum verification fails closed (was fail-open)

_verify_download_checksum / verifyDownloadChecksum previously logged a warning and used the binary when SHA256SUMS could not be fetched, or had no entry for the platform archive. Since every release publishes SHA256SUMS (and there's a build-provenance attestation), the client should enforce it:

• Missing checksums / missing entry now raise instead of proceeding.
• The existing CLOAKBROWSER_SKIP_CHECKSUM=true escape hatch is preserved (custom mirrors / offline builds).
• _fetch_checksums now skips an empty parse (e.g. a redirect to an HTML 404 page) and falls through to the next mirror, so a misbehaving primary can't shadow a good fallback or satisfy the check with junk. _parse_checksums requires a valid 64‑hex digest per line (the TS regex already did).

I verified that the live release SHA256SUMS is reachable and contains each platform's entry, so this does not break installs.

2. Version‑tag validation

The Chromium version comes from the GitHub release tag name and flows into cache paths, download URLs, and (Windows, TS client) the PowerShell zip‑extraction command. Added is_safe_version_tag / isSafeVersionTag (^\d+(\.\d+){0,9}$):

• _get_latest_chromium_version / getLatestChromiumVersion skip any release whose version isn't plain dotted‑numeric.
• Cache‑marker versions are validated before use in get_effective_version.
• TS zip extraction passes the archive/destination paths to PowerShell via environment variables instead of interpolating them into the -Command string, so a path/version containing a quote can't be parsed as code.

Tests

• New tests/test_supplychain_hardening.py (fail‑closed, mirror fall‑through, version validation) — passing.
• tsc --noEmit clean. (Pre‑existing Windows‑only failures in test_update/test_config/test_extract are unrelated — they hard‑code .tar.gz/POSIX paths.)

Deliberately NOT included here (to avoid duplicating existing open PRs)

• Opt‑in cloakserve authentication — already proposed in fix(cloakserve): opt-in --auth-token + explicit --host for the CDP surface (#217) #248.
• Archive‑extraction path‑ancestry hardening — already proposed in Harden archive extraction and add a doctor CLI #227 (Python side); the TS extractTar guard could get the same treatment as a follow‑up.

Happy to adjust scope, split, or rename anything if preferred.