[fransarriogisbert-gif]

Fixes #4241.

Prepared with AI assistance for fransarriogisbert-gif. This is the original patch reported in #4241, refreshed onto current main b1627e8; it is one contribution, not another bounty claim.

A completed HTTP response with the wrong bytes currently replaces an existing archive. Validate the API's optional digest field (sha256:<64 hex>) before downloading and verify SHA-256 before creating/replacing the archive. Missing/null digests retain legacy behaviour; redirect authentication and CRLF endings are unchanged.

Static review of the related PR #4250 shows that it reads sha256_sha, whereas GitHub's documented artifact-list response uses digest with the sha256: prefix:
https://docs.github.com/en/rest/actions/artifacts
Its current diff and fixtures therefore do not exercise the API field in this report. This PR retains our independently published #4241 implementation and fixtures using the documented field. No competing source was copied.

Validation (local, 13 Nov 2026):

• Original negative reproduction in [tooling] Verify advertised Actions artifact digests before publishing downloads (tested patch) #4241: 10 failing subtest assertions before the fix; focused suite 14/14 afterwards.
• On published head 8e685a03: 557 top-level tools tests + 25 fuzz-harness + 29 runner tests passed (611 total, no skips), plus registration/conflict/guarantees/claims/census guards.
• On published head 2675e51a, using checksum-verified official Go 1.26.9 / Rust 1.99.0: version guard passes; compiler workspace 3293 passed/0 failed/ignored; corpus 139/139 with tripwire not fired; managed gate 2/2; differential FULL 47/47 build-and-run + 92/92 reject.
• Current follow-up commit only updates evidence in PLAN.md, STATUS.md and spikes/actions-artifact-digest/RESULTS.md; code/tests are unchanged from the tested heads.
• Commands, provenance and limits: RESULTS.md.
• GitHub currently shows 4 workflows awaiting maintainer approval. No hosted CI pass or live Actions artifact download is claimed. The complete CI workflow, including its release integration sample, was not run locally.

Kept as a draft pending hosted CI and maintainer review. No merge, award, reserved funds or payment is claimed.