fix: make updater checksum verification self-contained

scripts/apply-binary-update.ps1

@@ -8,7 +8,8 @@ param(
   [Parameter(Mandatory = $true)][string]$LogPath,
   [Parameter(Mandatory = $true)][string]$StatusPath,
   [Parameter(Mandatory = $true)][string]$UpdateId,
-  [switch]$HandshakeOnly
+  [switch]$HandshakeOnly,
+  [switch]$VerifyOnly
 )
 
 $ErrorActionPreference = "Stop"
@@ -51,6 +52,16 @@ function Write-UpdateState {
 function Write-Log([string]$Message) {
   "{0} {1}" -f [DateTime]::UtcNow.ToString("o"), $Message | Add-Content -LiteralPath $LogPath -Encoding UTF8
 }
+function Get-Sha256([string]$Path) {
+  $stream = [IO.File]::OpenRead($Path)
+  $algorithm = [Security.Cryptography.SHA256]::Create()
+  try {
+    return ([BitConverter]::ToString($algorithm.ComputeHash($stream))).Replace("-", "").ToLowerInvariant()
+  } finally {
+    $algorithm.Dispose()
+    $stream.Dispose()
+  }
+}
 
 try {
   Write-UpdateState -State "started" -Message "Binary updater owns the update request."
@@ -59,9 +70,13 @@ try {
     Write-Log "Handshake-only verification completed successfully."
     exit 0
   }
-  $actualSha256 = (Get-FileHash -LiteralPath $BinaryPath -Algorithm SHA256).Hash.ToLowerInvariant()
+  $actualSha256 = Get-Sha256 -Path $BinaryPath
   if ($actualSha256 -ne $ExpectedSha256.ToLowerInvariant()) { throw "Binary update SHA-256 verification failed." }
   if (-not (Test-Path -LiteralPath $CurrentExecutable -PathType Leaf)) { throw "Current ForgeFlow executable was not found." }
+  if ($VerifyOnly) {
+    Write-Log "Verification-only SHA-256 check completed successfully."
+    exit 0
+  }
 
   Write-UpdateState -State "waiting-for-exit" -Message "Waiting for ForgeFlow to close."
   try { Wait-Process -Id $ParentPid -Timeout 60 -ErrorAction Stop } catch {