Simplify release DX: local manifest, optional hash, slimmer publish

release.sh writes updates/manifest.json at release time (predictable
asset URL) — no CI commit-back, no push-token problem, no detached
checkout dance. release_publish.sh is create-release + upload only.
Manifest sha256 now optional; updater skips verification with a note
when absent (HTTPS + gzip CRC cover the realistic cases). Fixed the
repo-URL sed keeping a .git suffix (caught by a worktree dry run).
Updater tests: 8 (sha-less manifest flow added).

.gitea/workflows/release.yml

@@ -34,7 +34,7 @@ jobs:
           name: linux-tarball
           path: dist/*.tar.gz
 
-      - name: Publish release + manifest
+      - name: Publish release
         if: startsWith(github.ref, 'refs/tags/v')
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}