feat(verify): SHA-256 integrity check of the engine lib (from 0.0.12)

On startup the plugin fetches the per-version {version}/verify.json from
ModelScope (remote-first; local cache in bin/<os>/ only when the network is
blocked) and verifies the installed engine lib's SHA-256 against it. On a
mismatch it self-heals: re-downloads the official artifact and replaces the
lib ONLY if the download's sha matches the manifest (verify-before-replace,
EXDEV/disk-safe), bounded to one heavy re-download per (version, expected).
Never blocks node loading; never touches a locally-compiled dev build.
gitignore the runtime verify cache + heal-state.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>