[refactor] fetch-wasm.js checksum

[MichaelWheeley]

What does this PR do?

• refactor scripts\fetch-wasm.js
• fetch WASM checksum, if ok skip full download
• improved checksum verification, checks both checksum file list against expected file list, and expected files against checksum list

Type of change

• Bug fix
• New feature
• Performance improvement
• Refactor / code cleanup
• Documentation
• Translation
• Map layer plugin

How to test

• npm run prebuild

Checklist

• App loads without console errors
• Tested in Dark, Light, and Retro themes
• Responsive at different screen sizes (desktop + mobile)
• If touching server.js: caches have TTLs and size caps (we serve 2,000+ concurrent users)
• If adding an API route: includes caching and error handling
• If adding a panel: wired into Modern, Classic, and Dockable layouts
• No hardcoded colors — uses CSS variables (var(--accent-cyan), etc.)
• No .bak, .old, console.log debug lines, or test scripts included

[accius]

The checksum-first skip is a good optimization: builds with a current bundle now download a few hundred bytes instead of the full wasm every time, and the two-way verification (expected files present in the checksum list AND every listed file hashing clean) closes the gap where a truncated sha256 file would pass silently. The response.resume() on redirects is a nice catch too, that was leaking sockets on every GitHub release redirect.

Fail-open semantics are preserved (any throw lands in warn() which exits 0 so builds never break on network trouble), which was the property I cared most about from the original review. Approving with two non-blocking nits if you feel like a follow-up:

• The mismatch error message interpolates the outer filename const, which is always 'p533.sha256', so a hash failure on p533.wasm reports the wrong file. Capturing which file failed inside verifyChecksum would make that diagnostic honest.
• fs.rmSync deletes the existing checksum file before the new download is known to succeed. Offline builds still ship the existing wasm (good), but they lose the checksum file, so every later build does a full re-download until the network is back. Downloading to a temp name and renaming on success would keep the fast path intact.

K0CJH

[MichaelWheeley]

follow up changes made in #1089