Harden cached release asset handling

[Vladyslav-Kuksiuk]

This PR:

• Hardens cached release asset verification and offline reuse.
• Rebuilds executables from verified assets instead of trusting mutable sidecars.
• Adds portable cache keys and symlink/path protections.
• Improves coverage for tampering, permissions, cleanup, and cache reuse.
• Makes HTTP failure tests deterministic with controlled responses and stronger assertions.

[Oleg-Melnik]

Substantial and careful rework of the install/cache trust model. The file-handling hardening (NOFOLLOW everywhere, per-component link rejection, Windows-junction detection, containment re-checks after moves) and the test additions (symlink/junction rejection, tampered-asset-with-rewritten-sidecar, permission restore, staged-temp cleanup, portable/case-distinct cache keys, deterministic HTTP assertions) are the strongest parts. No correctness bugs spotted. Inline comments are two behavior/trust-model decisions to confirm-and-document, one definite doc defect, two doc-content losses, and one cleanup. I reviewed the diff only; I did not run the build or tests.

[Oleg-Melnik]

@Vladyslav-Kuksiuk LGTM with comments to address.