gh run download into a reused dir picks the wrong artifact

When staging a GitHub Actions artifact, gh run download <run> -D <dir> adds a subfolder named after the artifact, but if <dir> was reused from an earlier download, a find <dir> -name app.zip | head -1 can return the older build's zip. Always download into a fresh mktemp -d, select the zip by its artifact-name path (e.g. one containing the head SHA), and verify an embedded commit (e.g. Info.plist key via PlistBuddy) against gh run view <run> --json headSha before installing. That check caught a build 93 commits stale.