Java provisioning: download + verify + extract a Temurin JRE into the app dir

[CaYatur]

Part of the Java auto-provisioning epic (slice 2, network).

Add src/main/core/javaProvision.ts that downloads a Temurin JRE and makes it usable by the launcher.

Flow

1. Resolve the Adoptium binary + checksum URLs from a pure builder (keep os/arch/jre/hotspot/GA segments in one testable function; map process.arch: x64→x64, arm64→aarch64).
2. Download to a temp file under the scratch/app temp dir, streaming, with progress callbacks (bytes / total).
3. Verify SHA256 against Adoptium's published checksum before touching anything executable. Abort on mismatch.
4. Extract with the existing zip-slip-safe approach (adm-zip + the assertNoZipSlip guard already used in core/worlds.ts) into a temp dir, then atomically rename into <baseDir>/java/temurin-<major>/. An interrupted install must never leave a half-tree for javaScan to probe.
5. _resetJavaCache() and return the resolved java executable path (probe it to confirm the major).

Verification honesty

The real download can't run in this dev env (network + a large binary). The URL builder + arch mapping + checksum-compare + extraction guard are smoke-tested; the end-to-end fetch is inspection-only and will be disclosed as a gap in the PR.

Known caveat

Storing an absolute <baseDir>/java/... path in javaPath breaks if the portable app is later moved. Accepted for now; noted in the PR body.