Raised when a downloaded archive fails SHA-256 verification.
Distinct from generic install failure so callers can surface a loud, user-visible notice — a checksum mismatch is a supply-chain anomaly (CDN poisoning, MITM, tampered mirror) and must not be silently treated like "you're offline".
