[2026 Registry] Verify downloaded template checksums

[Nanle-code]

Objective

Reject tampered or incomplete archives before extraction or scaffolding.

Target area

registry metadata and template downloader

Acceptance criteria

• The objective is implemented with clear handling for invalid input, unsupported environments, and failure paths.
• Automated tests cover the primary flow, at least one boundary case, and at least one failure case.
• User-facing documentation or developer guidance is updated, including compatibility, security, or migration notes where applicable.

Source: .github/roadmap-issues-2026-07-29.json.