Plugin installs now cryptographically verified

Plugin installations from ClawHub now include cryptographic verification. Before a plugin archive is installed, its SHA-256 hash is computed and compared against the expected value in version metadata. If the hashes don't match—or if the metadata lacks an integrity hash entirely—the installation fails closed, preventing potentially tampered or incomplete plugins from being loaded.

The implementation normalizes multiple hash formats that ClawHub may return, including base64 with sha256- prefixes, hex with sha256: prefixes, and raw hex strings. This flexibility prevents installations from breaking if ClawHub changes its metadata format, while still maintaining strict verification. Fallback ZIP verification has also been tightened for cases where metadata is malformed.

This change protects users from corrupted downloads, man-in-the-middle attacks during plugin fetching, and potentially malicious packages masquerading as legitimate ClawHub plugins. Plugin authors and administrators should see more reliable installs with clearer failures when something goes wrong.