Simplify release DX: local manifest, optional hash, slimmer publish

release.sh writes updates/manifest.json at release time (predictable
asset URL) — no CI commit-back, no push-token problem, no detached
checkout dance. release_publish.sh is create-release + upload only.
Manifest sha256 now optional; updater skips verification with a note
when absent (HTTPS + gzip CRC cover the realistic cases). Fixed the
repo-URL sed keeping a .git suffix (caught by a worktree dry run).
Updater tests: 8 (sha-less manifest flow added).

apps/desktop/test/updater_test.dart

@@ -16,15 +16,20 @@ void main() {
     expect(isNewerVersion('0.2.0', '0.1.9'), isFalse);
   });
 
-  test('manifest rejects missing fields', () {
+  test('manifest rejects missing fields, sha256 is optional', () {
     expect(() => UpdateManifest.fromJson({}), throwsFormatException);
     expect(
         () => UpdateManifest.fromJson({
               'version': '0.2.0',
               'protocol': 4,
-              'url': 'https://x/y.tar.gz',
             }),
         throwsFormatException);
+    final noSha = UpdateManifest.fromJson({
+      'version': '0.2.0',
+      'protocol': 4,
+      'url': 'https://x/y.tar.gz',
+    });
+    expect(noSha.sha256, isNull);
   });
 
   test('findInstallRoot honors bundle layout', () async {
@@ -162,6 +167,37 @@ void main() {
           'binary-v1');
     });
 
+    test('manifest without sha256 still applies', () async {
+      await server.close(force: true);
+      server = await HttpServer.bind(InternetAddress.loopbackIPv4, 0);
+      server.listen((req) async {
+        if (req.uri.path == '/manifest.json') {
+          req.response
+            ..statusCode = 200
+            ..write(jsonEncode({
+              'version': '0.2.0',
+              'protocol': 4,
+              'url':
+                  'http://127.0.0.1:${server.port}/watch-together-0.2.0.tar.gz',
+              'notes': '',
+            }));
+        } else {
+          req.response
+            ..statusCode = 200
+            ..add(tarball);
+        }
+        await req.response.close();
+      });
+      final root = await fakeRoot();
+      final rc = await runUpgrade(
+          currentVersion: '0.1.0',
+          manifestUrl: manifestUrl(),
+          installRoot: root);
+      expect(rc, 0);
+      expect(await File('${root.path}/watch_together').readAsString(),
+          'binary-v2');
+    });
+
     test('unknown layout asks for manual update', () async {
       final rc = await runUpgrade(
           currentVersion: '0.1.0',