Checkov 3.3.19 binaries (Terrapod-built mirror)

Checkov 3.3.19 binaries, built by Terrapod for the platforms its binary cache serves (#2066).

Upstream stopped publishing checkov_linux_arm64.zip at 3.3.21 (bridgecrewio/checkov#7729), which
made every security scan on an arm64 agent pool record errored. These are built from
upstream's own release tag, its committed Pipfile.lock and its committed checkov.spec,
on python:3.9-bookworm — the same recipe as its own nightly.yml, pinned to an
older glibc so the bundle runs on every runner image.

Each linux asset was executed before publication: upstream's own smoke test, plus the exact
--framework terraform_plan invocation the runner uses, asserting the graph checks fire.
checkov_darwin_X86_64.zip is upstream's own asset, re-hosted after verifying its digest.

Build provenance is attested — gh attestation verify <asset> --repo mattrobinsonsre/terrapod.

asset	sha256
checkov_darwin_X86_64.zip	f10faad31fffa5f6cd86642a509944c09536d9828f8a3127337f2cffd9b15163
checkov_linux_X86_64.zip	56397785b909cb17be527fc0dbfcdea29d4ae4e6c265cb9d6b50a38e50aecf0c
checkov_linux_arm64.zip	0e8531de8130017c90f8d58a74add6902a1ce4d2d59928930af03b1727dd784c

Served to deployments through registry.platform_tools.checkov_mirror_url.
This is not a Terrapod release.