Drop GitHub API calls from AI model discovery and download

[andriiryzhkov]

Removes all api.github.com calls from the AI model flow. Behind shared NAT (corporate networks, VPNs, cloud VMs, classrooms) the 60 req/hr unauthenticated quota gets exhausted quickly and "darktable can't download models" was going to be the predictable complaint after release.

• _find_latest_compatible_release: rewrote to fetch releases-index.json from raw.githubusercontent.com/<repo>/HEAD/releases-index.json (CDN, no API limit, branch-agnostic via HEAD so a future master→main rename doesn't break shipped binaries) instead of paginating api.github.com/repos/<repo>/releases.
• _fetch_asset_digest: now reads SHA from the release's own versions.json (same CDN path the manifest is already fetched from) instead of api.github.com/repos/<repo>/releases/tags/<tag>. Acts as the fallback for downloads that bypass dt_ai_models_check_updates.
• dt_ai_models_check_updates: parses the new nested versions.json shape ({ models: { id: { version, sha256 } } }) and pre-populates model->checksum, so the download flow has the SHA already when the user clicks download and the fallback above rarely fires.
• Schema-validation guard added on releases-index.json so a hypothetical future schema: 2 standalone file produces a clear log line instead of silent NULL.
• Download dialog UX fix: errors now close the progress dialog immediately and pop a standard GtkMessageDialog with the message, instead of leaving the "0% downloading: model" dialog stuck with the error crammed into a status label.

Net: zero api.github.com calls in the AI model discovery + download path.

Depends on

Requires darktable-org/darktable-ai#28 to be merged.

Trade-off worth flagging

There is no GitHub-side, non-API source of release-asset SHA256 – the digest is published only via the REST API. By switching to reading SHA from the maintainer-published versions.json, integrity verification is now gated on the maintainer doing the right thing in the model repo. The C code refuses to download an asset whose SHA it cannot resolve, so the failure mode is secure-by-default (user blocked) rather than silent (download without verification).

[TurboGit]

Thanks!