HIGH: Add integrity check for unsafe deserialize_unchecked in artifact loading

[AlexMikhalev]

Security Finding - HIGH

Source: Security audit (2026-02-24)
Location: crates/terraphim-automata/src/sharded_extractor.rs:215

Description

DoubleArrayAhoCorasick::deserialize_unchecked(bytes) is called on file data from disk with no integrity verification. If artifact files are tampered with, this could cause undefined behavior.

Remediation

1. Add SHA-256 checksum to ArtifactHeader and validate before deserialization
2. Consider using safe deserialize variant if available in daachorse
3. Document trust boundary: artifact files must be generated locally

[vbkaisetsu]

We released daachorse 2.0.0 featuring a safe deserialize() function with built-in checks.

[AlexMikhalev]

@vbkaisetsu great, if this will go forward I will keep it in mind