ensure_ripgrep

Ensure a usable rg binary is available, installing if necessary.

Resolution order:

1. If a managed rg exists and matches RIPGREP_VERSION, return it.
2. Otherwise, if a system rg is on PATH and no managed binary exists, return its resolved path. This is gated on the absence of a managed binary: once a managed rg exists, the pinned version always wins, so a stale managed binary is re-fetched rather than deferring to a system rg and the resolved version stays deterministic.
3. If offline, on an unsupported platform, or no asset matches the platform/arch, return None so callers fall back to the existing notification + slow path.
4. Otherwise download → SHA-256 verify → extract → install → prepend BIN_DIR to PATH → return the installed path. On a checksum mismatch, raises ChecksumMismatchError so callers can surface a loud notice; other failures log and return None.

A stale managed binary is never proactively deleted. The atomic replace in _install_ripgrep_sync overwrites it on success, and on failure the user is strictly better off keeping the older copy than being left with no rg at all.