feat: take the version and checksum from composer.json's extra

[lens0021]

mago is a Rust binary, so a project that installs it from its release archive has no
carthage-software/mago requirement for the version to live in — it states it under extra
instead. chaotic-ground/wikven does exactly that:

"extra": {
    "mago-version": "1.29.0",
    "mago-sha256": "5e99d1232fa93e6adc6feaaddaf2b46c148b2990173cdcf18400b474646bf046"
}

…and then repeats both values in the workflow that installs the tool. This reads them, so the
workflow repeats neither.

What changed

• extra.mago-version is read first, ahead of composer.lock and the composer.json
  requirement: stating it there is a statement about the binary, where a lockfile entry is about
  the package.
• extra.mago-sha256 is read with it — either one value, or an object keyed by target triple,
  which is the honest shape for something that differs per platform.
• A stated checksum is only offered for the version stated beside it. A workflow pinning a
  different version cannot end up verifying one archive against another's hash, and the sha256
  input still wins over the project's value.
• The effective checksum is a new sha256 output and part of the cache key, so changing a pin
  re-downloads and re-verifies rather than being handed what an earlier run cached.

Testing

• test/version-test.sh gains 9 cases: extra detection, extra winning over a lockfile that
  says something else, and the checksum rules (one value, per-triple object, the entry for another
  platform, no entry for this platform, a version nobody stated, a project that states nothing).
  It runs on ubuntu, macOS and Windows.
• The detect job installs from test/fixtures/extra and asserts both the version and that the
  archive was verified against the stated checksum, then requires test/fixtures/extra-wrong to
  stop the install — a checksum nothing enforces is worse than none.
• shellcheck, yamllint, rumdl, typos and zizmor pass locally.

Stacked on nothing: this is independent of #6, which touches only the platform mapping.

---

Generated by Claude Code