fix(design): verify the whiteboard bundle against SHA256SUMS before unpacking

[filipeforattini]

Problem

packages/core/src/design/whiteboard.ts fetched the whiteboard release tarball from GitHub Releases and piped it straight into tar -xzf: no checksum verification, no fetch timeout or abort signal, and a non-zero tar exit surfaced as a bare Error. The release build already generates and uploads SHA256SUMS alongside the tarball (packages/redcode/script/build.ts), but the loader never read it.

Fix

• Download SHA256SUMS from the same release, find the <sha256> redcode-whiteboard-<version>.tar.gz line, hash the tarball with Bun.CryptoHasher, and refuse to unpack on a missing entry or a mismatch.
• Both downloads run under a 60 s AbortSignal.timeout; HTTP errors, network errors and timeouts all become Design.Error unavailable (still 409) with a message naming the asset and the reason.
• tar exit code and stderr become a Design.Error; an archive that unpacks without whiteboard.js is rejected too. Extraction still happens in a temp directory that is only renamed into place after every check, so a partial install is never seen as cached and the next call retries.
• The release source (fetch, version, data, checkout, timeout) is a module-level Source with a configure() entry point so tests can serve a release from memory. Build script untouched.

Test

packages/core/test/design-whiteboard.test.ts gains six tests that serve a local tarball + SHA256SUMS through the injected fetch:

• verified tarball unpacks, renders, and is served from cache on the second call
• mismatched digest fails with unavailable, caches nothing, and the next call re-downloads and succeeds
• tarball missing from SHA256SUMS fails before the tarball is requested
• SHA256SUMS 404 fails with unavailable
• network error and timed-out download both fail with unavailable
• listed archive that tar cannot unpack fails cleanly with the exit code, nothing cached

Before the fix: 0 pass / 8 fail (the original loader has no injection point, configure is not a function). After: 8 pass / 0 fail (PLAYWRIGHT_BROWSERS_PATH=~/.cache/ms-playwright mise x -- bun test --timeout 30000 test/design-whiteboard.test.ts). bun run typecheck clean in packages/core and packages/redcode.

https://claude.ai/code/session_01KAcoL6wpgVEs2ebUrUGpHS

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}