fix(zcashd): verify managed binary cache

[ValarDragon]

Motivation

The managed zcashd resolver previously treated a cache entry as valid when a
sidecar file contained the manifest's archive digest. That did not verify the
cached executable bytes, so a replaced zcashd binary could be reused and
spawned.

Solution

Add the extracted executable's SHA-256 to the embedded release manifest.
The resolver now hashes the cached binary and compares it directly with that
manifest pin before reuse. Installation also verifies the extracted binary
before persisting it. The obsolete archive-digest sidecar is no longer trusted.

Release Docker context preparation and the local compat Docker Make target now
verify the extracted executable too. The release checklist requires recording
both the archive and executable digests for each managed artifact.

The regression test replaces a successfully installed cached executable, then
confirms the next resolution downloads and restores the manifest-pinned binary.

Test evidence

• cargo fmt --all -- --check
• cargo test -p zakura zcashd_compat::managed --locked
• cargo clippy -p zakura --lib -- -D warnings
• bash -n scripts/resolve-zcashd-compat-manifest.sh
• make -n compat-zcashd-prepare

cargo clippy -p zakura --all-targets -- -D warnings is currently blocked by
an existing unused import in zakurad/tests/acceptance.rs.

Issue

No linked issue.

AI disclosure

Used OpenAI Codex to implement the cache-integrity verification and regression
test.

[v12-auditor]

Note

Complete: Audit complete. V12 did not find any issues that need review.

Open the full results here.

Analyzed two files, diff 18dbc60...49e7e25.