[jabrailkhalil]

What & why

Adds regression coverage for the checksum helpers when the asset or manifest lives under a parent directory containing spaces, and when the helper is invoked by absolute path from an unrelated working directory. Scope is spaces in parent directories only; helper behaviour is unchanged.

Closes #23

Changes

Extends the reject-tampered-checksum job in .github/workflows/test.yml:

• POSIX (Ubuntu and macOS): copies the fixture and its manifest into "$RUNNER_TEMP/dir with spaces" and invokes scripts/verify-checksum.sh by absolute path from $RUNNER_TEMP. The valid invocation succeeds, then a tampered copy fails with the existing error: checksum verification failed for sotto-fixture.
• The fixture copies and path resolution happen before the macOS PATH restriction, so this leg also exercises the shasum fallback with spaced paths.
• PowerShell (Windows): the same regression against scripts/verify-checksum.ps1, deriving the manifest hash from the copied fixture so line-ending differences in the working copy cannot invalidate it.

No new dependencies, no extra runners, no release downloads. Tracked fixtures are untouched.

Verification

Replicated both blocks locally:

• Ubuntu container (Linux leg, sha256sum path): valid and tampered spaced checks pass.
• Same container with a restricted PATH of shasum + awk (macOS leg fallback): valid and tampered spaced checks pass.
• Windows PowerShell 5.1: valid and tampered spaced checks pass.

Commits are signed off (git commit -s) per the issue instructions.

[Maxerns]

Thanks @jabrailkhalil this is thorough work. I executed the POSIX spaced-path cases end to end here in both PATH modes (full and shasum-fallback) and they pass exactly as written. Approving ci now and ill merge when its green