chore(tools): add checksum for socket-basics archive

[John-David Dalton (jdalton)]

Summary

Adds a SHA-256 checksum for the socket-basics source archive in bundle-tools.json and wires it through the downloader so it gets verified like every other bundled tool.

Before

socket-basics was the one entry in bundle-tools.json without a checksums block, so its download went unverified while the other tools (opengrep, trivy, trufflehog, sfw, python, etc.) all had per-asset SHA-256 entries enforced.

After

• bundle-tools.json now has:

  "checksums": {
    "socket-basics-v2.0.2.tar.gz": "ba17...eb13"
  }

• downloads.mts passes sha256: archiveSha256 into the same httpDownload(...) helper the rest of the tools use, and throws if the checksum entry is missing (matching the existing pattern at lines 327–345 / 472–508).

Notes

• The checksum key uses the tag-qualified filename (socket-basics-v<ver>.tar.gz) to stay consistent with the asset-keyed checksums elsewhere in the file and the local-path convention used in downloads.mts.
• Future version bumps can be handled by the /sync-checksums skill that already exists for the other tools.

Test plan

• pnpm run type green
• node scripts/validate-checksums.mts green
• pnpm run build:cli succeeds
• CI green (exercises the SEA build path which actually fetches the archive)

---

Note

Low Risk
Small, scoped change that only tightens download verification for a bundled tool; primary risk is build failures if the checksum key/name is incorrect.

Overview
Adds a checksums entry for the socket-basics GitHub source tarball in bundle-tools.json.

Updates SEA build tooling to require that checksum and pass it to httpDownload when fetching the socket-basics archive; the build now fails fast with a clear error if the checksum is missing.

^{Reviewed by Cursor Bugbot for commit f4844e9. Configure here.}