Add pinned native voice source preparation

[copyberry]

Add pinned native voice source preparation

What changed

• Pin the GStreamer, codec, native library, and build-tool archives needed by
  the native voice runtime, including their SHA-256 digests.
• Add lazy Bazel repositories and a manual //third_party/voice:sources target
  for fetching and unpacking the pinned archives.
• Add an offline Python adapter that verifies archive identity and extraction
  bounds, refuses existing output directories, cleans up failed preparations,
  and records a completion receipt.
• Document that this stage prepares source inputs only; it does not compile or
  link the libraries or enable voice.

Testing

• Add unit coverage for digest failures, unsafe links, expansion limits,
  cleanup after extraction failures, existing-output preservation, and systems
  where archive links cannot be created.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}