azd update: checksum verification and TOCTOU mitigation

## Problem
Downloads trust HTTPS only — no checksum verification. Staged binary sits in user-writable `~/.azd/staging/` with no integrity hash stored at staging time, creating a TOCTOU (time-of-check-to-time-of-use) gap between staging and apply.

## Proposed
- Verify SHA256 checksum after download against a published checksum file
- Store integrity hash alongside staged binary; verify before apply
- Consider restricting staging directory permissions

## Context
Raised in design review #6910 and PR #6942 code review. Note: danieljurek commented that SHA does not need to be checked since download is over HTTPS only — team should decide if this is an accepted risk.

Parent epic: #6721