verify-pin-bump

Use when a model SHA-256 mismatch surfaces (download_verified errors, manifest_tests failures, a fresh download hashing differently from the rust/src/models/manifest.rs pin, kesha install failing after an update, a KESHA_MODEL_MIRROR swap producing a different hash, or an upstream HuggingFace re-upload). Walks through the safe bump procedure — verify the upstream weights deliberately, then update the pin. Refuses to…