Download the artifact to a local file, inspect it, and verify its pinned SHA-256 before any separately approved execution.