feat: identify expected base ROMs in generated patches

[ClausValcaTD]

Summary

Generated patches now ship with a JSON sidecar manifest describing the exact base ROM and target ROM used to create them.

What changed

• Add <patch-file>.json sidecars for file-based patch formats.
• Record source/target filename, byte size, CRC32, and SHA-256.
• Validate the expected base ROM before applying a patch when a manifest is present.
• Reject mismatched source ROMs with an actionable error showing the expected and actual SHA-256.
• Treat the manifest validation as an explicit passed integrity check in the patch report.
• Surface the generated manifest path in the Build Patch result card.
• Allow ignoreChecksum to bypass manifest validation consistently with existing checksum behavior.
• Add tests covering manifest round-tripping and wrong-base rejection.

IPS, xdelta, APS, PPF, EBP, and similar formats retain their original binary format; the metadata lives in the sidecar so existing patch tools remain compatible. DCP directory patches are unchanged in this first iteration.

Validation

• Flutter/Dart formatting passed.
• Flutter analyze passed.
• Flutter tests passed.
• Dart core formatting, analysis, and tests passed.