Simplify release DX: local manifest, optional hash, slimmer publish

release.sh writes updates/manifest.json at release time (predictable
asset URL) — no CI commit-back, no push-token problem, no detached
checkout dance. release_publish.sh is create-release + upload only.
Manifest sha256 now optional; updater skips verification with a note
when absent (HTTPS + gzip CRC cover the realistic cases). Fixed the
repo-URL sed keeping a .git suffix (caught by a worktree dry run).
Updater tests: 8 (sha-less manifest flow added).

docs/ROADMAP.md

@@ -25,9 +25,9 @@ desktop 17 + 7 updater.
 ## Backlog (priority order, each one sitting-sized)
 
 1. First real release: `tool/release.sh` (derives the version,
-   no typing) → review → `git push --follow-tags` → CI
-   (`release.yml`) builds the tarball, publishes the Forgejo
-   release, and commits the manifest back. Verifies the whole
+   writes the manifest, no typing) → review →
+   `git push --follow-tags` → CI (`release.yml`) builds the
+   tarball and publishes the Forgejo release. Verifies the whole
    `--upgrade` chain end to end. Manual fallback is
    `tool/package_linux.sh` + `tool/release_publish.sh <tag>`.
 2. Jumpy seek: live repro with timeline log first, then fix the