Function verify_checksum 

pub fn verify_checksum(tarball: &[u8], sidecar_url: &str) -> Result<()>

Verify against the .sha256 sidecar asset — mandatory (krew rule: a missing checksum is a failed install, not a warning).