test: update #930 release-validation for the checksum URL refactor

The #952 release-validation suite asserted the exact #930 URL literals. This PR
builds the archive and checksums.txt from a shared $base (so they always come
from the same release), so update those assertions to the $base/$url form, and
convert the now-obsolete "verification deferred" test.todo into a real assertion
that Test-Checksum verifies SHA256 before extraction.

(This test never ran on this PR until it was retargeted from the merged
feat/windows-powershell-installer branch to main.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019M7GkS3bYZaFhEbBhVTecG

Author: ralphstodomingo

packages/opencode/test/release-validation/windows-installer-930-codex.test.ts

@@ -24,8 +24,12 @@ function upgradePowershellBlock() {
 
 describe("PR #930 install.ps1 release URL construction", () => {
   test("uses only HTTPS GitHub release URLs for Windows zip assets", () => {
-    expect(INSTALL_PS1).toContain('"https://github.com/AltimateAI/altimate-code/releases/latest/download/$filename"')
-    expect(INSTALL_PS1).toContain('"https://github.com/AltimateAI/altimate-code/releases/download/v$specificVersion/$filename"')
+    // The archive and checksums.txt share one $base so they always resolve to the
+    // same release (see verify_checksum / Test-Checksum). $base is the latest
+    // download path or the pinned release tag; $url and $checksumsUrl derive from it.
+    expect(INSTALL_PS1).toContain('$base = "https://github.com/AltimateAI/altimate-code/releases/latest/download"')
+    expect(INSTALL_PS1).toContain('$base = "https://github.com/AltimateAI/altimate-code/releases/download/v$specificVersion"')
+    expect(INSTALL_PS1).toContain('$url = "$base/$filename"')
     expect(INSTALL_PS1).toContain('"https://api.github.com/repos/AltimateAI/altimate-code/releases/latest"')
     expect(INSTALL_PS1).not.toMatch(/http:\/\/(?:github\.com|api\.github\.com|www\.altimate\.sh)/)
   })
@@ -62,9 +66,13 @@ describe("PR #930 install.ps1 release URL construction", () => {
 })
 
 describe("PR #930 install.ps1 download and archive safety", () => {
-  // BUG: install.ps1 currently documents that SHA256/signature verification is deferred
-  // and relies only on HTTPS. Release assets should be verified before extraction.
-  test.todo("verifies downloaded archive integrity with SHA256 or a signature before extraction", () => {})
+  test("verifies downloaded archive integrity with SHA256 before extraction", () => {
+    // Closed by the checksum-verification work: Test-Checksum fetches checksums.txt
+    // and compares SHA256, and the verify call precedes the actual extraction.
+    expect(INSTALL_PS1).toContain("Test-Checksum -Path $zipPath")
+    expect(INSTALL_PS1).toContain("Get-FileHash -Path $Path -Algorithm SHA256")
+    expect(INSTALL_PS1.indexOf("Test-Checksum -Path")).toBeLessThan(INSTALL_PS1.indexOf("Expand-Archive -Path"))
+  })
 
   test("fails curl.exe downloads on HTTP errors and checks curl exit status", () => {
     const installTarget = scriptBlock("function Install-Target", "$needsBaseline")