refactor(build): share the ISO download/verify step (FR-095)

[Avicennasis]

Closes #48087. Extracts the identical download_iso() (cached ISO fetch + detached-signature verification) from build-rescue-usb.sh and build-wipe-usb.sh into bin/lib/iso-lib.sh, sourced by both. bash -n clean on all three.

[Avicennasis]

The runtime extraction appears behavior-preserving, and bash -n passes, but it regresses the repository's own lint script. ./tests/shellcheck.sh now reports six new warnings from the extraction: SC2034 for SYSRESCUE_SIG_URL and sig_path in each caller, plus SC2154 for iso_path and sig_path in bin/lib/iso-lib.sh. (The three warnings in autorun/wipe-lib.sh already exist on main.)

Please make the shared interface statically explicit—preferably pass the paths/URLs/key/version as function arguments—or add narrowly justified ShellCheck source/global annotations so this refactor adds no lint debt. git diff --check and GitHub's CodeQL/release-drafter checks are green, but GitHub currently does not run this repo's shell test/lint script.