Check the sources still downloaded at generation against pinned checksums #136

ADR 0014 commits each real-world dataset's prepared source and checks it against a pinned SHA-256, except where the license keeps it out of the repository. Of those, actg is pinned (its prepared source is checked when generation prepares it), but two are not checked by AFABench:

• imagenette: ImagenetteDataset downloads imagenette2-320.tgz from fast.ai's S3 bucket and extracts it unchecked. The archive downloaded on 2026-10-14 has SHA-256 569b4497c98db6dd29f335d1f109cf315fe127053cedf69010d047f0188e158c (docs/reference/datasets/imagenette.md).
• mnist: torchvision checks MD5s it pins itself; AFABench pins nothing, so a torchvision upgrade could change what is accepted.

Pin and check the Imagenette archive's SHA-256 before extracting, and decide whether MNIST needs AFABench's own pin.