#3744 ci: check installer digests before running them

Nine workflow steps piped a downloaded install script directly into a shell. The managed SAST scan reported each of them as a real finding (curl pipe to shell).

Each step now downloads the installer to a file, checks its sha256 against a pinned value, and only then runs it. package_sandbox_kit.yaml already uses this pattern for the Chainloop CLI. The change covers:

• The Chainloop CLI installer in author_verification.yml, codeql.yml, package_chart.yaml, sync_contracts.yml and release.yaml (2 steps).
• The Syft and Grype installers in release.yaml.
• The Dagger installer in lint.yml.

When a vendor publishes a new installer, the step fails with a digest mismatch. The comment next to each pinned value tells how to re-pin it.

Refs PFM-8051.

AI disclosure: Claude Code helped to write this change.