Add defense-in-depth verification for downloaded Unraid ZIPs

Scope:

• Security hardening/enhancement for installer runtime ZIP handling.
• Does not block making the repository public unless release owners choose to gate launch on this defense-in-depth work.

zip.sh downloads release metadata and ZIP payloads, while create_flash_boot.sh extracts the selected ZIP and executes make_bootable_linux from that archive as root.

Risk:

• Compromised metadata, transport, mirror content, or an unexpected URL can become root code execution.
• Stronger host and payload verification would reduce supply-chain exposure before archive-provided code runs as root.

Acceptance criteria:

• Release URLs are constrained to approved hosts and schemes.
• ZIP payloads are verified through a signed manifest or independently trusted checksum before use.
• Root execution of archive-provided scripts is explicitly justified, minimized, and gated on verification success.
• Failure messaging clearly tells users when integrity verification fails.

Start by reading zip.sh and create_flash_boot.sh, tracing release metadata and ZIP handling through extraction to make_bootable_linux. Confirm how URLs, payload integrity, and root execution are currently handled. Done means approved URLs, independently trusted verification, gated root execution, and clear integrity-failure messages meet the acceptance criteria.