🐛 fix(seed): verify downloaded wheel digests - #3251

download_wheel() ran pip download and handed the result straight to
the seeder with no check on the bytes it got back. Everything else in
this path is verified: the embedded pip/setuptools wheels carry a
BUNDLE_SHA256 checked on every load, but a wheel fetched over the
network for the periodic-update or --download path had no equivalent.
A compromised index, a stale mirror, or a MITM'd download could
substitute a different file under the same name and have it seeded
into every virtual environment created afterward.

verify_wheel_digest() computes the downloaded file's sha256 and
compares it against the digest PyPI's public JSON API reports for
that exact distribution, version, and filename - an independent
source of truth regardless of which index actually served the file.
A missing or unreachable PyPI record only means the check cannot run,
since a private index PyPI has never heard of is a legitimate setup
(air-gapped installs, corporate mirrors), so that case is logged and
the wheel is let through unverified, matching the existing best-effort
posture of the periodic-update feature. An actual mismatch is fatal:
the wheel is never cached or seeded.

This intentionally does not touch how pip resolves its index
(PIP_INDEX_URL and friends stay untouched) - pointing the seed
download at an internal mirror is a legitimate, common setup, and
the digest check is the correct backstop regardless of which index a
wheel came from.

for more information, see https://pre-commit.ci

verify_wheel_digest() treated PyPI's published digest as
authoritative for any wheel matching a given distribution, version,
and filename, regardless of where pip actually fetched it from. A
private index can legitimately serve a rebuilt or repackaged wheel
under that same identity - an internal mirror re-signing a release
for policy reasons, for example - and the check would reject that
legitimate artifact just because it differs from the public PyPI
copy, even though it came from exactly the source it was configured
to come from.

download_wheel() now skips the PyPI cross-check whenever
PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX names a custom
index. This only catches the common, explicit way of pointing pip
elsewhere; a pip.conf file has the same effect and stays invisible
here, so this is a conservative signal against false rejections, not
a guarantee the check runs whenever it safely could.