Simplify release DX: local manifest, optional hash, slimmer publish

release.sh writes updates/manifest.json at release time (predictable
asset URL) — no CI commit-back, no push-token problem, no detached
checkout dance. release_publish.sh is create-release + upload only.
Manifest sha256 now optional; updater skips verification with a note
when absent (HTTPS + gzip CRC cover the realistic cases). Fixed the
repo-URL sed keeping a .git suffix (caught by a worktree dry run).
Updater tests: 8 (sha-less manifest flow added).

HANDOFF.md

@@ -289,8 +289,10 @@ remain in session_screen.dart.
     (wired in `tool/package_linux.sh`; dev runs report
     `0.0.0-dev`). Publishing is CI-driven: tag `vX.Y.Z` →
     `.gitea/workflows/release.yml` builds, creates the Forgejo
-    release, uploads the tarball, commits the manifest back
-    (`tool/release_publish.sh` does the same by hand).
+    release, uploads the tarball. Manifest is written locally by
+    `release.sh` (predictable asset URL, no CI roundtrip);
+    sha256 is optional — skipped with a note when absent
+    (HTTPS + gzip CRC cover the realistic cases).
     Manual trigger only: bump desktop pubspec in a release commit
     first (script enforces tag == pubspec). No silent
     proto jumps: updater warns when manifest protocol != local.