[Vivian-04]

PR #613 ci presets: the stellar-cli download is not checksum-verified

Description

The CI preset templates and GitHub workflows installed stellar-cli by piping curl ... | tar xz from GitHub release archives. While STELLAR_CLI_VERSION was pinned, the archive was not verified against a cryptographic checksum prior to extraction. A tampered or truncated archive could therefore be unpacked and executed with job secrets in scope (specifically STELLAR_DEPLOYER_SECRET in the deploy workflow).

This PR:

1. Adds STELLAR_CLI_SHA256 alongside STELLAR_CLI_VERSION in presets/github/testnet-deploy.yml and .github/workflows/bindings-typecheck.yml.
2. Downloads the archive to a temporary file (/tmp/stellar-cli.tar.gz) and verifies its SHA-256 with sha256sum -c before archive extraction.
3. Ensures that any checksum mismatch fails immediately before tar is called, preventing execution of untrusted binaries.
4. Cleans up the temporary archive after extraction.
5. Documents the checksum verification and how to update STELLAR_CLI_VERSION alongside STELLAR_CLI_SHA256 in presets/README.md.
6. Adds unit test deploy_preset_verifies_archive_checksum_before_extraction in crates/ci-presets/src/lib.rs to assert that generated deploy workflows include STELLAR_CLI_SHA256, do not pipe curl to tar, and run sha256sum -c before tar xz.
7. Fixes pre-existing assertion in writes_jenkins_pipeline_at_repository_root to match cargo +stable in the Jenkins template.

---

Acceptance Criteria Checklist

• Each preset downloads the archive to a file and checks it against a SHA-256 pinned next to STELLAR_CLI_VERSION.
• A mismatch fails the job before extraction.
• Updating the version means updating the hash, documented in presets/README.md.

---

Changes by File

• presets/github/testnet-deploy.yml: Added STELLAR_CLI_SHA256 env var and updated install-stellar-cli to download to /tmp/stellar-cli.tar.gz, verify with echo "${STELLAR_CLI_SHA256} $ARCHIVE" | sha256sum -c, extract with tar xz -f, and clean up.
• .github/workflows/bindings-typecheck.yml: Applied the same download-and-verify pattern for stellar-cli v28.0.0 with its SHA-256 hash.
• presets/README.md: Added "Updating stellar-cli in presets" documenting how to download the release archive, calculate the SHA-256 hash, and update the workflow file.
• crates/ci-presets/src/lib.rs: Added unit test deploy_preset_verifies_archive_checksum_before_extraction and updated Jenkinsfile test assertion.

---

Verification

• Ran cargo test -p soroban-forge-ci-presets. All 35 tests pass including deploy_preset_verifies_archive_checksum_before_extraction.

Closes #613