Offline artifact download does not verify SHA-256 checksums after fetching

kubescape download artifacts fetches framework and rule files for air-gapped environments but performs no integrity verification on the downloaded content. A corrupted download, a network interception, or a compromised mirror would produce wrong scan results with no indication that anything is wrong.

For a CNCF incubating project that is part of supply-chain security tooling, this is a meaningful gap. Tools like kubectl, helm, and cosign all publish checksums alongside release assets and verify them on install.

Steps to reproduce:

Run kubescape download artifacts --output /tmp/ks-artifacts Corrupt one of the downloaded files: echo "corrupted" >> /tmp/ks-artifacts/nsa.json Run kubescape scan --use-artifacts-from /tmp/ks-artifacts Observe that the scan completes with no error and silently uses the corrupted rules

Expected behavior: The download command fetches a checksums.txt published alongside the release assets, verifies each file's SHA-256 after download, and exits with a non-zero code and a clear error if any file does not match.

Actual behavior: Files are downloaded and used as-is with no integrity check.

Suggested fix: Publish a checksums.txt file with each release containing SHA-256 hashes for all artifact files. In cmd/download/download.go, fetch this file first, then verify each downloaded artifact against its entry. Fail loudly if any hash does not match. This also opens the door to supporting Sigstore/cosign signing in a follow-up.