[template-sync.just] Fix error handling and path matching

[chicks-net]

Review comments identified these issues:

• compute_checksum missing error branch (10/15 PRs) - Line 68 has no else clause on failure. Fix: add `else exit 1`
• cleaned_files directory matching ambiguous (9/15 PRs) - Uses exact-path matching but should use prefix matching for directories (lines 97, 126)
• Downloaded files not checksum-verified (6/15 PRs) - Line 99 downloads without integrity check. Fix: verify checksum before applying

Identified in code reviews across 15 PRs using gh-process v5.8.