fix(e2e): verify preview toolchain artifacts

.github/workflows/runner-full-stack-e2e.yml

@@ -1113,16 +1113,50 @@ jobs:
             echo "::error::Public preview sanitizer requires Ubuntu Noble, got ${VERSION_CODENAME:-unknown}" >&2
             exit 1
           fi
-          sudo apt-get update -qq
-          sudo apt-get install --no-install-recommends -y \
-            "imagemagick=8:6.9.12.98+dfsg1-5.2build2" \
-            "imagemagick-6.q16=8:6.9.12.98+dfsg1-5.2build2" \
-            "libgif7=5.2.2-1ubuntu1.2" \
-            "liblept5=1.82.0-3build4" \
-            "libtesseract5=5.3.4-1build5" \
-            "tesseract-ocr=5.3.4-1build5" \
-            "tesseract-ocr-eng=1:4.1.0-2" \
-            "tesseract-ocr-osd=1:4.1.0-2"
+          tool_root="$(mktemp -d)"
+          trap 'rm -rf "$tool_root"' EXIT
+          download_verified_package() {
+            local filename="$1"
+            local expected_sha256="$2"
+            local url="$3"
+            curl --fail --silent --show-error --location \
+              --proto '=https' --tlsv1.2 \
+              "$url" -o "$tool_root/$filename"
+            printf '%s  %s\n' "$expected_sha256" "$tool_root/$filename" | sha256sum --check --strict
+          }
+          download_verified_package \
+            "imagemagick-6.q16_6.9.12.98+dfsg1-5.2build2_amd64.deb" \
+            "5dd63a2b9343783caa918c6d74d0dfb708ff7b6ebf5b5d4a22ef9c8adbc73f2f" \
+            "https://archive.ubuntu.com/ubuntu/pool/universe/i/imagemagick/imagemagick-6.q16_6.9.12.98+dfsg1-5.2build2_amd64.deb"
+          download_verified_package \
+            "imagemagick_6.9.12.98+dfsg1-5.2build2_amd64.deb" \
+            "8b072461337a6ed7f03feef46c9b68f7668ba7d625332c590785431676864c17" \
+            "https://archive.ubuntu.com/ubuntu/pool/universe/i/imagemagick/imagemagick_6.9.12.98+dfsg1-5.2build2_amd64.deb"
+          download_verified_package \
+            "libgif7_5.2.2-1ubuntu1.2_amd64.deb" \
+            "8137945ac9167f26d0264f403ffb48a45974f096e8acab5479e33fdba6c28a36" \
+            "https://security.ubuntu.com/ubuntu/pool/main/g/giflib/libgif7_5.2.2-1ubuntu1.2_amd64.deb"
+          download_verified_package \
+            "liblept5_1.82.0-3build4_amd64.deb" \
+            "c2bb81d58f032b09917c0d50994cce905287a1596304a4e99681a03601456ea8" \
+            "https://archive.ubuntu.com/ubuntu/pool/universe/l/leptonlib/liblept5_1.82.0-3build4_amd64.deb"
+          download_verified_package \
+            "libtesseract5_5.3.4-1build5_amd64.deb" \
+            "a38438115dc203b5abc1e6a6b24eb5273ba82161a11faa2f619bf5f7622efb14" \
+            "https://archive.ubuntu.com/ubuntu/pool/universe/t/tesseract/libtesseract5_5.3.4-1build5_amd64.deb"
+          download_verified_package \
+            "tesseract-ocr_5.3.4-1build5_amd64.deb" \
+            "2dfac382d77215aee0c3de4a2a2205505d5f2195e72e79b54ad32154fc08da77" \
+            "https://archive.ubuntu.com/ubuntu/pool/universe/t/tesseract/tesseract-ocr_5.3.4-1build5_amd64.deb"
+          download_verified_package \
+            "tesseract-ocr-eng_4.1.0-2_all.deb" \
+            "b1996b3113c78663f4dd16cf18aa1f288b07e9624f8d4a0ddbd7d9b52a234ba7" \
+            "https://archive.ubuntu.com/ubuntu/pool/universe/t/tesseract-lang/tesseract-ocr-eng_4.1.0-2_all.deb"
+          download_verified_package \
+            "tesseract-ocr-osd_4.1.0-2_all.deb" \
+            "a266496b3268134493808c1595c9d16ac92c7e1c28e3e0bf46fdb322df95ca68" \
+            "https://archive.ubuntu.com/ubuntu/pool/universe/t/tesseract-lang/tesseract-ocr-osd_4.1.0-2_all.deb"
+          sudo dpkg --install "$tool_root"/*.deb
 
           verify_package_version() {
             local package="$1"