feat(installer): add DownloadAndExtractStep with SHA256 verify

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/ClaudeDo.Installer/Core/InstallContext.cs

@@ -27,4 +27,6 @@ public sealed class InstallContext
 
     // InstallPage
     public bool CreateDesktopShortcut { get; set; } = true;
+
+    public string? InstalledVersion { get; set; }
 }

src/ClaudeDo.Installer/Steps/DownloadAndExtractStep.cs

@@ -0,0 +1,79 @@
+using System.IO;
+using System.IO.Compression;
+using ClaudeDo.Installer.Core;
+
+namespace ClaudeDo.Installer.Steps;
+
+public sealed class DownloadAndExtractStep : IInstallStep
+{
+    private readonly IReleaseClient _releases;
+
+    public DownloadAndExtractStep(IReleaseClient releases)
+    {
+        _releases = releases;
+    }
+
+    public string Name => "Download and Extract";
+
+    public async Task<StepResult> ExecuteAsync(InstallContext ctx, IProgress<string> progress, CancellationToken ct)
+    {
+        progress.Report("Fetching latest release metadata...");
+        var release = await _releases.GetLatestReleaseAsync(ct);
+        if (release is null)
+            return StepResult.Fail("Could not reach the release server. Check your network connection and try again.");
+
+        var zipAsset = release.Assets.FirstOrDefault(a =>
+            a.Name.StartsWith("ClaudeDo-", StringComparison.OrdinalIgnoreCase) &&
+            a.Name.EndsWith(".zip", StringComparison.OrdinalIgnoreCase));
+        var checksumAsset = release.Assets.FirstOrDefault(a =>
+            a.Name.Equals("checksums.txt", StringComparison.OrdinalIgnoreCase));
+
+        if (zipAsset is null)
+            return StepResult.Fail("Release zip asset not found in release metadata.");
+        if (checksumAsset is null)
+            return StepResult.Fail("checksums.txt not found in release metadata.");
+
+        var scratchDir = Path.Combine(Path.GetTempPath(), "ClaudeDo-install-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(scratchDir);
+
+        try
+        {
+            var zipPath = Path.Combine(scratchDir, zipAsset.Name);
+            var checksumPath = Path.Combine(scratchDir, "checksums.txt");
+
+            progress.Report($"Downloading {zipAsset.Name} ({zipAsset.Size / (1024 * 1024)} MB)...");
+            await _releases.DownloadAsync(zipAsset.BrowserDownloadUrl, zipPath,
+                new Progress<long>(b => progress.Report($"  {b / (1024 * 1024)} MB downloaded")),
+                ct);
+
+            progress.Report("Downloading checksums...");
+            await _releases.DownloadAsync(checksumAsset.BrowserDownloadUrl, checksumPath,
+                new Progress<long>(_ => { }), ct);
+
+            progress.Report("Verifying checksum...");
+            var map = ChecksumVerifier.ParseChecksumsFile(File.ReadAllText(checksumPath));
+            if (!map.TryGetValue(zipAsset.Name, out var expectedHash))
+                return StepResult.Fail($"No checksum entry for {zipAsset.Name} in checksums.txt.");
+            if (!ChecksumVerifier.Verify(zipPath, expectedHash))
+                return StepResult.Fail("Checksum mismatch — the downloaded zip may be corrupt or tampered with.");
+
+            // Only after verification do we touch the install directory.
+            progress.Report("Clearing previous app/worker binaries...");
+            var appDest = Path.Combine(ctx.InstallDirectory, "app");
+            var workerDest = Path.Combine(ctx.InstallDirectory, "worker");
+            if (Directory.Exists(appDest)) Directory.Delete(appDest, recursive: true);
+            if (Directory.Exists(workerDest)) Directory.Delete(workerDest, recursive: true);
+
+            progress.Report("Extracting...");
+            Directory.CreateDirectory(ctx.InstallDirectory);
+            ZipFile.ExtractToDirectory(zipPath, ctx.InstallDirectory, overwriteFiles: true);
+
+            ctx.InstalledVersion = release.TagName.TrimStart('v', 'V');
+            return StepResult.Ok();
+        }
+        finally
+        {
+            try { Directory.Delete(scratchDir, recursive: true); } catch { /* best effort */ }
+        }
+    }
+}