fix(hopper): retain launcher digests in verification diagnostics

Expose the verified launcher digest in doctor and preserve both digest facts
when signed package bytes disagree with release metadata.

Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>

src/application/DoctorDiagnostics.ts

@@ -231,6 +231,7 @@ const optionalHopperVersionCheck = async (
     details: inspected.ok
       ? {
           reported_release_version: inspected.value.version,
+          launcher_sha256: inspected.value.sha256,
           primary_fingerprint: inspected.value.primaryFingerprint,
           source: inspected.value.source,
         }

src/application/LinuxHopperPublisher.ts

@@ -228,7 +228,7 @@ export class LinuxHopperPublisher {
         return err(
           new HopperReleaseError(
             "integrity",
-            "The signed package launcher does not match main_exe_hash in the release feed.",
+            `The signed ${family} package launcher SHA-256 ${mainExeHash} differs from the release main_exe_hash ${release.main_exe_hash}.`,
           ),
         );
       retainProof(packageProofs, proofKey, verified.value);

tests/boundary/setup/linuxHopperPublisherVerification.test.ts

@@ -253,7 +253,13 @@ describe("Linux signed cache tampering", () => {
             undefined,
             f.publicKey,
           ),
-        ).toMatchObject({ ok: false, error: { reason: "integrity" } });
+        ).toMatchObject({
+          ok: false,
+          error: {
+            reason: "integrity",
+            message: expect.stringContaining(f.release.main_exe_hash),
+          },
+        });
         expect(
           await f.publisher.verifyArchive(
             "deb",