fix: aliases-kubectl v0.13.1 — reliable kubectl download with checksum verification

[szymonos]

Summary

• Replace the naive download-retry loop in Set-KubectlLocal (which only re-tried on missing-file and could leave a corrupt/partial binary in place) with a new internal Invoke-KubectlDownload helper.
• Invoke-KubectlDownload fetches the official .sha256 checksum first (aborting before any download on failure), streams the binary to a temporary .part file with progress reporting and a 5-minute request timeout, verifies the SHA256 before accepting, and only then atomically moves the verified file into place — so an interrupted or corrupted download never replaces a known-good binary. A clean {} block always removes leftover partial files.
• Bump aliases-kubectl ModuleVersion 0.13.0 → 0.13.1 (PATCH) in the same module-only commit.

Test plan

• make lint-diff — pre-commit hooks green (gremlins/shebang/EOF/whitespace/line-ending)
• /second-opinion (gpt-5.3-codex heterogeneous review) — no findings
• Run Set-KubectlLocal on Linux/macOS/Windows and confirm the correct-arch kubectl is downloaded, checksum-verified, and symlinked
• Simulate a checksum mismatch / interrupted download and confirm the existing binary is left untouched and the .part file is cleaned up

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR hardens aliases-kubectl’s Set-KubectlLocal workflow by introducing a checksum-verified, atomic kubectl downloader to prevent partial/corrupt binaries from replacing an existing known-good install.

Changes:

• Add Invoke-KubectlDownload (internal) to download kubectl via streaming + progress, verify against the published .sha256, and move into place only after verification.
• Update Set-KubectlLocal to use the new downloader instead of the previous WebClient retry loop.
• Bump aliases-kubectl module version to 0.13.1.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
modules/aliases-kubectl/Functions/internal.ps1	Adds Invoke-KubectlDownload for checksum verification + atomic placement.
modules/aliases-kubectl/Functions/helper.ps1	Switches Set-KubectlLocal to call the new internal downloader.
modules/aliases-kubectl/aliases-kubectl.psd1	Bumps ModuleVersion from 0.13.0 → 0.13.1.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[szymonos]

Reviewed the 3 Copilot findings on `Invoke-KubectlDownload`; resolving as won't-fix:

• Line 94 (InnerException null-access): false positive. This module runs without `Set-StrictMode`, and PowerShell member access on `$null` returns `$null` rather than throwing (unlike C#). The `??` operator is exactly the guard for a null `InnerException` — it falls through to `$_.Exception.Message`. Already null-safe.
• Line 86-87 (null `.Dispose()` in `finally`): false positive — scope misread. The `finally` pairs with the inner `try` that begins after both `$srcStream` and `$dstStream` are assigned; control only reaches it once both constructors succeeded, so neither is ever `$null` there.
• Line 101/108 (`Get-FileHash`/`Move` outside try/catch): intentional. The caller ignores the return value, so failing loud on an IO/move error is preferable — it stops `Set-KubectlLocal` before it symlinks a bad binary. The `clean {}` block still removes the temp file.