Require Download Digests

When downloading remote security-sensitive artifacts (e.g., kernels, binaries, containers), require an expected cryptographic digest (e.g., sha256:<hex>) and verify it before use. Treat missing digests for custom/variable URLs as a policy violation (fail closed) to prevent unverified or tampered downloads.

Example config pattern:

[kernel]
url = "https://example.com/artifact.tar.zst"
digest = "sha256:0123...abcd" # REQUIRED when url is custom/remote

Example enforcement pattern (pseudo-code):

let url: URL = config.url
let expectedDigest: String? = config.digest

guard let expectedDigest else {
  // Fail closed for non-default/custom URLs
  throw SecurityError.missingDigestForRemoteDownload
}

let data = try download(url)
let actualDigest = sha256(data)
precondition(actualDigest == expectedDigest)

Apply this to any code path that fetches from the network using a configurable URL and then executes/consumes the artifact.