fix(selfupdate): verify GitHub release asset digests

[Sayt-0]

Summary

Addresses the self-update failure reported in #3871.

Docker Agent releases expose a SHA-256 digest through GitHub release asset metadata but do not publish checksums.txt. Self-update therefore failed with HTTP 404 after downloading the new binary.

Changes

• Read and validate the GitHub release asset SHA-256 digest before downloading
• Pin the initial download URL to the expected repository, tag, and asset
• Reject malformed URLs, unexpected ports, userinfo, queries, and fragments
• Limit redirects to HTTPS and at most 10 hops
• Verify downloaded bytes against the release asset digest and fail closed
• Preserve only the minimal non-secret environment required to validate the staged binary
• Keep API keys, GitHub tokens, and proxy credentials out of the validation process environment

Issue coverage

#3871 concern	Status
Sandbox template version skew	Already addressed on main by using docker/docker-agent-sbx-templates:latest
Self-update requests missing checksums.txt	Addressed by this change
DMR ignores --models-gateway	Addressed separately by #3875
inspect exec timeout and orphaned process	Belongs to the sbx lifecycle implementation

This PR intentionally does not close #3871 because the remaining concerns are tracked outside this change.

Validation

• go test ./...
• task lint
• task build
• Linux and Windows cross-builds
• Live macOS update from v1.119.0 to v1.120.0 using the published GitHub asset
• Verified final version and commit after re-exec
• Verified no update or backup files remained