feat(install): opt-in checksum verification for downloaded deps

[Chemaclass]

Context

Releases already ship a checksum asset, but installed deps are never verified. An opt-in integrity check closes the supply-chain loop.

Scope

• Add an opt-in mode (e.g. verify=true in setup, or a per-URL #sha256=... annotation in .bashdep) that verifies a downloaded file against an expected sha256 using shasum/sha256sum (portable, already used by release.sh).
• On mismatch: fail loudly (non-zero, stderr), do not write the lockfile entry, remove the bad file.
• Default off — no behavior change for existing users.

Boundary

Files: bashdep (download path, setup), tests, docs/api.md, docs/behavior.md, CHANGELOG.md. Depends on the .bashdep-format decision — settle that in the issue before coding.

Acceptance criteria

• Matching checksum installs normally; mismatch fails and leaves no lockfile entry or file
• Off by default; opt-in documented
• Tests for match, mismatch, and missing-tool fallback

---

Constraints (apply to all bashdep work)

• Bash 3.2+ compatible — no declare -A, ${var,,}/${var^^}, mapfile, negative array index, &>>.
• Zero runtime deps beyond curl/wget/awk/mktemp/mkdir/rm/cp/mv/printf/cat/grep/sort/tr/dirname/basename + shell builtins.
• TDD: write the failing test first (tests/unit/*_test.sh), then implement; keep make test green for the right reason. Mock curl/wget — no network in tests.
• Quality gate: make test && make sa && make lint must all pass.
• Update docs/api.md / docs/behavior.md when public API or semantics change; add a CHANGELOG.md ## [Unreleased] entry for any user-visible change.
• Conventional commits (ref: for refactors); never mention AI/automation. One PR per issue, assigned to Chemaclass.