feat: update installer SHA256 hashes for Python, DotNetInstallScript, SevenZip, and NodeJS

template/Install-CIToolchain-WinBuild2022.ps1

@@ -236,11 +236,11 @@ function Assert-Hash {
 $script:Hashes = @{
     # python-<PythonVersion>-amd64.exe from https://www.python.org/downloads/release/python-XYZ/
     # Update $script:Hashes['Python'] when $PythonVersion changes.
-    'Python'                  = ''
+    'Python'                  = '698F2DF46E1A3DD92F393458EEA77BD94EF5FF21F0D5BF5CF676F3D28A9B4B6C'
 
     # dotnet-install.ps1 from https://dot.net/v1/dotnet-install.ps1
     # Changes with each .NET SDK release cycle — verify after any dotnet version bump.
-    'DotNetInstallScript'     = ''
+    'DotNetInstallScript'     = 'CE5330422F1D3E9B3D46462A24EF7105F660EC6C67EF3F5D4AE05B7259FB4234'
 
     # vs_buildtools.exe bootstrapper from aka.ms/vs/stable/vs_buildtools.exe
     # Stable within a VS release cycle — update when VS major version changes.
@@ -252,7 +252,7 @@ $script:Hashes = @{
 
     # 7-Zip MSI installer from https://www.7-zip.org/download.html
     # Update $script:Hashes['SevenZip'] when $SevenZipVersion changes.
-    'SevenZip'                = ''
+    'SevenZip'                = 'A47EA8DCF8BC08E6DE474CAE77C828E031FA22CB528F6095DEFFFEBF11CD02F2'
 
     # Tier-2 Toolchain installer hashes — fill in when pinning supply chain (see BEST-PRACTICES.md §1.3)
     # PowerShell-<ver>-win-x64.msi from https://github.com/PowerShell/PowerShell/releases
@@ -262,7 +262,7 @@ $script:Hashes = @{
     # cmake-<ver>-windows-x86_64.msi from https://github.com/Kitware/CMake/releases
     'CMake'                   = ''
     # node-v<ver>-x64.msi from https://nodejs.org/dist/v<ver>/
-    'NodeJS'                  = ''
+    'NodeJS'                  = '2C0CC97EC64C1E4111362E1E32E0547FD870E4D9C79EC844C117DA583F21B386'
     # gh_<ver>_windows_amd64.msi from https://github.com/cli/cli/releases
     'GhCli'                   = ''
     # WiX: installed via 'dotnet tool install wix' — integrity via NuGet package signing