Verify Qwen3 ASR engine downloads

[Blackspirits]

Summary

Qwen3 ASR already maintains current archive hashes in DownloadHashManager, but the engine downloader on the old base returned downloaded archives to the unpack flow without authenticating them. This current-base port preserves the previously reviewed integrity check exactly.

This change:

• verifies every Qwen3 ASR engine archive against the existing platform/variant hash key
• fails closed when the resolver or hash registry has no digest
• rewinds the verified/rejected stream for the existing unpack/install flow
• carries the focused regressions for all seven current archive digests and a tampered HTTP payload unchanged

Current-base verification

• Qwen3AsrCppDownloadService.cs is byte-for-byte identical between old review base c694526d77d92e98e5ed1449d4dbb1925a68adac and current upstream 7dbf7e03c937241ff9511ae413d5552720249de1 (blob 366f451ced7f34d07d36e834c5444a9170332c0d)
• the previously reviewed production/test blobs were transplanted exactly onto the current upstream tree; no merge conflict or unrelated edit was introduced
• current diff is one commit / two files
• all seven hashes were previously independently verified against the official niksedk/qwen3-asr.cpp v0.1.8 release asset digests
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34744778507

Base is current upstream 7dbf7e03c937241ff9511ae413d5552720249de1.

This PR supersedes internal draft #26.

AI assistance: ChatGPT was used to independently verify exact base-file identity and transplant the already-reviewed Qwen3 ASR integrity fix onto current upstream without modifying unrelated code.