Enforce SHA256 verification on every binary install path

Three gaps allowed an unverified binary to reach a trusted location:

- The ffmpeg ZIP fallback logged a warning on checksum mismatch and
  installed anyway (the 7z path already aborted). Abort instead.
- The yt-dlp auto-update path downloaded and renamed the binary over
  the verified one with no checksum at all. Verify against the official
  SHA2-256SUMS like the first-install path, and use atomic os.replace.
- The yt-dlp first install streamed the download directly to the
  trusted path and only verified afterwards; a crash in between left an
  unverified executable to be run on next launch. Download to .part and
  os.replace only after verification.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ytsage/core/ytsage_ffmpeg.py

@@ -282,9 +282,14 @@ def install_ffmpeg_windows(progress_callback=None) -> bool:
             if progress_callback:
                 progress_callback("🔐 Verifying download integrity...")
             if not verify_sha256(temp_file, FFMPEG_ZIP_SHA256_URL):
-                logger.warning("SHA-256 verification failed for zip file, proceeding anyway...")
+                logger.error("SHA-256 verification failed for zip file, aborting installation")
                 if progress_callback:
-                    progress_callback("⚠️ SHA-256 verification failed, proceeding anyway...")
+                    progress_callback("❌ SHA-256 verification failed, aborting installation")
+                try:
+                    Path(temp_file).unlink(missing_ok=True)
+                except Exception:
+                    pass
+                return False
 
             logger.info("Extracting FFmpeg components from zip archive...")
             if progress_callback: