Verify declared upstream sources and final GGUF artifact SHA-256 digests.