Add checksum verification to curl and npx installers

[Copilot]

GoReleaser generates checksum files (defang_<version>_checksums.txt) but installers don't verify them, allowing corrupted or tampered binaries to be installed.

Changes

curl installer (src/bin/install):

• Downloads checksum file from GitHub releases
• Verifies archive SHA256 using sha256sum or shasum -a 256
• Exits with error code 11 on checksum mismatch

npx installer (pkgs/npm/src/clilib.ts):

• Added downloadChecksumFile() to fetch checksums from s.defang.io
• Added verifyChecksum() using Node's crypto module for SHA256 validation
• Throws error and cleans up files on checksum mismatch

Behavior:

• Checksum mismatch → installation fails (security)
• Checksum file unavailable → warning logged, installation continues (backward compatibility)

Tests: Added unit tests covering success, failure, and error cases for npx installer.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/DefangLabs/defang/releases/latest
  • Triggering command: /usr/bin/curl curl -fsSL REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Installers do not verify checksums</issue_title>
<issue_description>Goreleaser generates checksum files, but the installers (brew/npx/curl) do not use/verify them.</issue_description>

<agent_instructions>skip brew, because it builds from source. </agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Installers do not verify checksums #1902

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.