Extract reusable managed-binary installation infrastructure

[navedmerchant]

Parent

Part of #1049. This is the first independently reviewable slice of the Destructive Command Guard work.

Problem

The existing Semble downloader owns a large amount of archive download, checksum, extraction, versioning, cleanup, and concurrent-install logic. DCG needs the same lifecycle guarantees. Duplicating that logic would make both binary integrations harder to audit and maintain.

Scope

• Introduce shared managed-binary helpers for bounded downloads, checksum verification, safe archive extraction, and atomic/versioned installation.
• Handle cancellation, oversized downloads, partial installs, stale artifacts, executable permissions, and concurrent VS Code windows.
• Migrate the existing Semble downloader to the shared helpers without changing Semble behavior.
• Add focused regression tests for the shared helpers and update the Semble downloader tests.

Out of scope

• DCG-specific metadata or execution.
• Settings, auto-approval, command execution, or chat UI changes.

Acceptance criteria

• Semble still installs and resolves its binary through the shared infrastructure.
• Downloads are size-bounded and clean up streams/files on failure.
• Archives reject unsafe or unexpected entries.
• Installation is atomic and safely adopts an installation completed concurrently by another window.
• Focused managed-binary and Semble tests pass.
• The branch type-checks/builds independently from main.

Stack

Base: main. The DCG service issue will build on this issue.