Install a verified Ookla CLI for adaptive SQM

[Jason-Morcos]

Problem

Adaptive SQM currently pipes the packagecloud repository bootstrap into a shell, removes any existing speedtest package, and installs an unpinned candidate with apt. That can fail when UniFi OS changes its Debian base, mutates a vendor-managed package surface, and makes the calibration binary drift independently of Network Optimizer.

Fix

• install the official Ookla archive directly into /data/network-optimizer/bin
• pin the same 1.2.0.84 (ea6b6773cf) build selected by the existing packagecloud install path
• select reviewed aarch64, armhf, or x86_64 artifacts and verify both archive and executable SHA-256 values
• bound the HTTPS download, extract in a private staging directory, and atomically activate the validated executable
• invoke and report health for that exact path/build without removing a UniFi package
• report jq separately alongside the existing bc dependency status

Validation

• regression tests cover the release/build pin, checksums, bounded atomic install, absence of packagecloud/package removal, managed invocation, status checks, and generated Bash syntax
• full Release solution build: succeeded
• full Release solution tests: all projects passed, including 260 SQM tests and 1,281 Web tests

No gateway package, SQM script, cron entry, service, or live installation was changed while validating this fix.