Compare semantic JCEF checksums

[jinyiwei2012]

Summary

• compare the semantic SHA-256 token instead of the complete checksum-file representation
• reject malformed remote checksum content before it can replace the installed marker
• preserve first-install, real-update, and malformed-local-marker recovery behavior
• replace the marker with Files.move(..., REPLACE_EXISTING) instead of unchecked File.renameTo(...)
• add focused JUnit coverage for checksum formats and marker state transitions

Fixes #143.

Why

The MCEF mirror currently serves checksum files as PowerShell Get-FileHash table output containing headers, padding, line endings, and a CI runner path in addition to the actual 64-character hash.

FileUtils.contentEquals(...) treats changes to any of those non-semantic bytes as a JCEF update and can trigger a complete runtime download even when the actual SHA-256 value is unchanged.

Behavior preserved

• equal semantic hashes skip the JCEF download, regardless of checksum-file formatting or hex case
• a different valid remote hash replaces the marker and requests the JCEF download
• a valid remote marker replaces a malformed local marker and requests the JCEF download
• a first-time valid marker is installed and requests the JCEF download
• genuine local file I/O failures still propagate

Invalid remote content

The downloaded marker must contain exactly one standalone 64-character hexadecimal SHA-256 token. Missing, truncated, embedded-in-a-longer-hex-string, or multiple tokens are rejected. The temporary file is removed and an existing valid marker remains unchanged.

Tests

• Java 21 isolated compilation: passed
• JUnit Platform Console: 17 tests, 17 passed
• Gradle :common:test: 17 tests, 17 passed
• git diff --check: passed

Scope

This PR intentionally does not change archive caching, resumable downloads, file locking, mirror selection, or the libraries path. Those are separate improvements from the semantic checksum comparison fixed here.

This change was developed with AI assistance and manually reviewed and verified against the current mirror artifacts and the Gradle test suite.