findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it

security-audit-v3 #15. download_file already had a verify branch; no caller
used it and every *_SHA256 in versions.sh was a commented placeholder, so a
tampered mirror tarball flowed straight into configure/make and the shipped
WASM.

- versions.sh: 13 pins (cross-checked against Homebrew/Buildroot/nixpkgs/
  FreeBSD/vcpkg/boost.org/curl PGP; glm .zip is TOFU), boost/curl/libgit2
  versions moved beside their pins.
- all 13 download_file call sites pass "${NAME_SHA256}".
- download_file refuses an empty or malformed pin (PCBJAM_ALLOW_UNPINNED=1
  to bootstrap a new dep); file_sha256 prefers sha256sum, falls back to shasum.
- scripts/deps/check-pins.sh: static 3-arg check + offline file:// enforcement
  test; runs in wasm-build.yml before the deps cache, on cache hits too.

Expect one cold --build-deps run: the deps-cache key hashes versions.sh.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GcsgJZ77bhZatLAVU8R84H

scripts/deps/build-protobuf.sh

@@ -44,7 +44,7 @@ if [ ! -d "${PROTOBUF_DIR}" ]; then
     # Protobuf 3.21.x uses tag format v21.12 (major version 3 is implicit)
     PROTOBUF_TAG_VERSION="${PROTOBUF_VERSION#3.}"  # Strip leading "3." -> "21.12"
     PROTOBUF_URL="https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOBUF_TAG_VERSION}/protobuf-cpp-${PROTOBUF_VERSION}.tar.gz"
-    download_file "${PROTOBUF_URL}" "protobuf-${PROTOBUF_VERSION}.tar.gz"
+    download_file "${PROTOBUF_URL}" "protobuf-${PROTOBUF_VERSION}.tar.gz" "${PROTOBUF_SHA256}"
     tar -xzf "protobuf-${PROTOBUF_VERSION}.tar.gz"
     rm "protobuf-${PROTOBUF_VERSION}.tar.gz"
 fi