fix: validate retained test-tool identities

[sylvesterkaczmarek]

Summary

Make the retained cargo-llvm-cov validator require the exact supported platform matrix and official source identities, rather than accepting any four checksum-valid records.

Problem

script/validate-test-tools compares the committed lockfile and generated manifest, validates versions and checksums, and requires exactly four retained cargo-llvm-cov artifacts. On the base commit, however, it does not verify that those four records are the intended four platform/architecture/target tuples, and it does not bind their recorded URLs to the official release locations.

Because the lockfile and generated manifest are checked against each other, the same malformed or relabelled record can appear in both and still satisfy that equality check. Counting four records is not equivalent to proving the four supported host artifacts are represented exactly once.

Evidence / reproduction

• The intended matrix in the current lock is:
  • linux-x86_64 | x86_64 | linux | x86_64-unknown-linux-gnu
  • linux-aarch64 | aarch64 | linux | aarch64-unknown-linux-gnu
  • macos-x86_64 | x86_64 | macos | x86_64-apple-darwin
  • macos-aarch64 | aarch64 | macos | aarch64-apple-darwin
• script/validate-test-tools currently checks only that each artifact record is non-empty, has the expected version, points to a safe relative path, hashes to the recorded digest, contains the executable, and that the total count is four.
• script/install-test-tools later selects the retained artifact by the runtime platform and target, so these identity fields are operationally significant.
• Minimal structural reproduction on the base validator: duplicate one valid platform record and remove another, update both the lock and generated manifest consistently, and keep four valid retained archives/digests. The count and lock/manifest equality checks do not independently reject the missing platform identity.
• Similarly, the base validator does not derive the expected artifact URL or licence URL from the reviewed tool/version identity; a lock and manifest that agree on another URL can pass the source-field checks as long as the retained bytes match the recorded digest.

Change

• require exactly the four reviewed platform | arch | os | target tuples
• reject duplicate platform records
• derive and require the official cargo-llvm-cov release URL for each target
• derive and require the corresponding vendored archive path
• derive and require the official upstream URLs for the Apache and MIT licence records
• preserve all existing checksum, archive, offline-install and licence-content validation

No retained artifact bytes, versions, or installation behavior change.