Verify before running / no shell-piping or trust-store changes

Windows: Get-FileHash -Algorithm SHA256 -LiteralPath .\DOWNLOADED-BUNDLE.zip
Linux:   sha256sum DOWNLOADED-BUNDLE.zip
Compare with the official https://actions.tbench.in/install download entry.

After extraction, inspect verify-bundle.py. Run it only with your existing
Python 3.12+ environment that already has cryptography installed:
Windows: py -3 .\verify-bundle.py
Linux:   python3 ./verify-bundle.py
No dependency is installed, downloaded or executed by this verifier.
It refuses missing/extra files, altered bytes, aliases and wrong signatures.

The archive and manifest come unchanged from /releases/v0.2.2-k2.
Never install a self-signed root certificate, disable SmartScreen/Gatekeeper,
or bypass your organization's application policy to use this bundle.
