ArcBox-managed host tool download, installation, and management.
Reads tool versions and checksums from assets.lock, downloads managed host
binaries (Docker CLI tools, kubectl, and future ArcBox-owned helpers),
verifies SHA-256 checksums, and installs them to ~/.arcbox/runtime/bin/.