Replace checksum flags with policy option

[mtj0928]

Purpose

This PR replaces checksum-related Boolean CLI flags with a single checksum validation policy option, while preserving the current checksum validation behavior.

User-visible Changes

Checksum behavior is now selected with --checksum-policy skip|warn|require.

For example, allowing a direct artifact bundle URL without providing a checksum changes from a dedicated Boolean flag to an explicit policy value:

# Before
nest install https://example.com/foo.artifactbundle.zip --allow-unverified

# After
nest install https://example.com/foo.artifactbundle.zip --checksum-policy warn

run and bootstrap still accept the released --skip-checksum-validation flag as a hidden compatibility alias. The unreleased --allow-unverified and --require-checksum flags are removed from the public CLI surface.

Core Changes

• Introduce ChecksumValidationPolicy as the shared policy model for checksum validation.
• Route CLI parsing through ChecksumValidationPolicyArgument.
• Replace internal combinations of checksum Booleans with explicit policy values.
• Keep default behavior warning-based unless NEST_REQUIRE_CHECKSUM requests strict validation.
• Preserve the direct artifact URL safeguard: installs without a checksum still require an explicit checksum decision.

Details

• --checksum-policy warn is the explicit allow-with-warning mode for missing checksums.
• --checksum-policy skip bypasses checksum validation.
• --checksum-policy require requires checksum validation and reports missing checksums as an error.
• NEST_REQUIRE_CHECKSUM=1 still maps to require when no CLI policy is provided.
• --checksum and --checksum-policy skip are mutually exclusive.
• README examples and checksum guidance are updated to use --checksum-policy.
• Tests cover policy parsing, hidden compatibility aliases, removed unreleased flags, and direct artifact URL behavior.

Verification

• swift test
• git diff --check