fix(nvidia): move the gpgcheck assertion into the command so the Arch arm can skip honestly - #12

on-PATH charly 2026.268.1917 != pinned 2026.278.0912 — downloading the pinned engine (the welded plugin-review differs; a stale engine produces no verdict)