Manifest-backed install can silently place unverified binaries

[dimonjolo]

Found while reviewing commit 18f6f9c. Two related gaps in UnlockerService.InstallModeAsync
for manifest-backed modes (BST):

1. If manifest.File is not among the extracted files (e.g. upstream renames the
   payload path in latest.toml), the staged.TryGetValue(...) check silently
   skips verification, and unverified dwmapi.dll / xinput1_4.dll / OpenSteamTool.dll
   get copied into the Steam root. Fix: treat a missing payload file as an install
   failure instead of skipping the check.

2. Loader DLLs are never hash-checked for manifest modes (only OpenSteamTool.dll
   is). Since manifest.Version names a real GitHub release, the releases API
   publishes per-asset sha256 digests — so the zip can additionally be verified
   against the tagged release's asset digest when the API is reachable, and skipped
   otherwise (no new failure mode; the raw manifest still vouches for the payload).

Also hardens ParseUpdateManifest against inline # comments and unterminated strings.

A ready patch (35 insertions, 5 deletions, UnlockerService.cs only) is attached.
Tests: 205 passed; the two LuaVaultTests failures reproduce on clean main, unrelated.

luatools-verify-fixes.patch