Verify the lz4.exe downloaded in the Windows release job #109

.github/workflows/build-all-and-publish.yml:183 downloads lz4_win64_v1_10_0.zip from the lz4/lz4 GitHub release with no checksum. It then runs lz4.exe (used by LZ4FrameIOStreamTest) in the same job and workspace that builds the Windows DLL uploaded into the published jar.

The C source is pinned through the submodule, and actions are pinned by SHA, so this zip is the only upstream input that can change without a reviewable change here. Release assets of v1.10.0 are most likely mutable.

Fix: pin the SHA-256 and fail if it doesn't match.

$expected = '<SHA256>'
if ((Get-FileHash lz4_win64.zip -Algorithm SHA256).Hash -ne $expected) { throw "lz4 zip digest mismatch" }

Get the hash on a trusted machine. Cross-check it with the asset digest from gh api repos/lz4/lz4/releases/tags/v1.10.0, and with an independent record such as the Scoop or winget manifest.

Optional follow-up: run the CLI-dependent Windows tests in a separate job that downloads the built DLL artifact, and use -DskipTests in the job that produces it.