A small correction on the opening story. A SHA-256 check can't fail "by one character": flip one hex digit in the file and about half the bits of the digest change, so the two hashes look unrelated. The hash tells you the file differs, a byte diff tells you where. Since the file moved in pieces, listing a hash per piece in the manifest would point straight at the bad chunk.
Hayrullah Kar