fix(ci): verify supplied installer checksums

[codeforester]

Summary

• Always hash the exact tagged Base install.sh bytes used by downstream automation.
• Reject malformed supplied checksums before the update.
• Reject valid-format supplied checksums that do not match the downloaded release artifact.
• Persist only the verified downloaded digest into downstream pins.

Issue

Fixes #2188

Validation

• bash -n .github/workflows/downstream-version-bumps.yml
• env -u BASE_HOME BASE_CACHE_DIR=/private/tmp/base-issue-2188-cache PYTHONPATH=lib/python:cli/python /Users/rameshhp/.base.d/base/.venv/bin/python -m pytest -q tests/test_github_workflows.py tests/test_downstream_version_bump.py
• 46 passed
• git diff --check

Security Notes

Supplied checksums are now verified against the immutable release-tag artifact before downstream pins are written.