download_and_verify previously returned the downloaded archive unverified
when a release had no SHA256SUMS.txt asset, or when fetching it returned a
non-2xx status. Restructure so the only path to Ok is an exact SHA-256
match: absent asset, non-success fetch, filename-not-found, and hash
mismatch all return Err. Adds a distinct ChecksumUnavailable variant and
wiremock coverage for each failure mode plus the matching happy path.
Refs #202
James Maes