[astrojerms]

Changes

• Validate full algorithm:hex-digest values for all six Proxmox-supported algorithms and normalize hexadecimal case.
• Send checksum and checksum-algorithm to download-url; require a trackable task and successful exitstatus before importing an image.
• Record verified digest provenance on newly created templates and refuse checksum-pinned cache reuse without an exact matching record.
• Add mismatch/cache/error-boundary regression coverage; remove the old download forwarding-only test and update documentation.

Verification

• Regression failed before the fix: a wrong digest reached template creation; it passes after.
• Proxmox/client/provider tests passed, including race detection; make build passed for all binaries.
• Real Proxmox 9.1.1 native-handler smoke: wrong SHA-256 rejected before VM/template creation; correct digest imported a never-booted disposable raw disk; second VM reused the verified template without redownload; mismatched cache pin rejected.
• Removed both sandbox VMs, template and downloaded image; dev-system VM 102 remained running. Removed throwaway source.
• Local full Go suite: all checksum-related packages passed; one unchanged GitOps periodic-pull timing test failed under the full run and passed in isolation. Full PR CI must pass before merge.

Compatibility

• Existing manifests without a checksum retain unverified-download behavior.
• With a checksum, legacy unverified templates or differing digests fail closed; use an unused cloudImage.templateName for a newly verified template.
• DownloadToStorage callers now supply a validated ImageChecksum value; no compatibility shim.

Closes #160