av: restore the strict sha256 check on vendored source tarballs

The corresponding-source archive must match the exact bytes pyav-ffmpeg
built the shipped libraries from, so a hash mismatch stays a hard failure
until the maintainers decide how to handle regenerated GitHub archives.

Author: luhenry

.github/workflows/build-av.yml

@@ -120,19 +120,11 @@ jobs:
               )
               digest = hashlib.sha256(path.read_bytes()).hexdigest()
               if digest != package.sha256:
-                  message = (
+                  raise SystemExit(
                       f"{package.name}: sha256 mismatch for {package.source_url}\n"
                       f"  expected {package.sha256}\n  got      {digest}"
                   )
-                  # GitHub regenerates /archive/ tarballs on demand and their bytes are
-                  # not stable across git releases (the content is the same tag), so a
-                  # hash drift there is not evidence of tampering. Keep failing hard for
-                  # every other host, where the file is a fixed release artefact.
-                  if "github.com/" in package.source_url and "/archive/" in package.source_url:
-                      print(f"::warning::{message}")
-                  else:
-                      raise SystemExit(message)
-              print(f"{package.name}: {name} ({path.stat().st_size} bytes, sha256 {digest[:12]})")
+              print(f"{package.name}: {name} ({path.stat().st_size} bytes, sha256 ok)")
               return path