ci: authenticate downloaded tool execution

[loadingalias]

Summary

• authenticate every direct CI executable with an exact repository-owned SHA-256 or OCI digest before extraction or execution
• replace Cargo-binstall and installer-action fallbacks with exact package-manager installs in fresh, uncached roots
• pin and verify Wasmtime, Zig, Codecov, Scorecard, Cargo, Go, APT, OPAM, and Rustup boundaries
• add deterministic integrity, cache-poisoning, fallback, platform, and installer-ownership regressions

Security properties

• missing or malformed metadata, unsupported platforms, mutable URLs, and checksum mismatches fail closed
• invalid downloads cannot reach extraction, installation, execution, or an unauthenticated fallback
• cached Cargo binaries and metadata, Go module state, and OPAM switches cannot bypass the selected integrity policy

Validation

• scripts/ci/tool-integrity-test.sh
• bash -n and ShellCheck for changed shell scripts
• just check-actions
• just check
• just test
• just check-all
• just test --all
• real scripts/ci/install-tools.sh minimal source-install integration
• scripts/ci/pre-push.sh --light
• just push

APT and OPAM command selection is deterministically mock-tested locally; live runner integration remains for CI.