Simplify release DX: local manifest, optional hash, slimmer publish

release.sh writes updates/manifest.json at release time (predictable
asset URL) — no CI commit-back, no push-token problem, no detached
checkout dance. release_publish.sh is create-release + upload only.
Manifest sha256 now optional; updater skips verification with a note
when absent (HTTPS + gzip CRC cover the realistic cases). Fixed the
repo-URL sed keeping a .git suffix (caught by a worktree dry run).
Updater tests: 8 (sha-less manifest flow added).

tool/release.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 # Cut a release without typing a version anywhere: derives the next
 # version (patch by default), bumps all three pubspecs in lockstep,
-# commits, and tags. Review, then `git push --follow-tags` — CI takes
-# it from there (build, Forgejo release, manifest commit-back).
+# writes updates/manifest.json (predictable asset URL — no CI roundtrip
+# needed), commits, and tags. Review, then `git push --follow-tags` —
+# CI takes it from there (build, Forgejo release, asset upload).
 # Usage: tool/release.sh [patch|minor|major] [--dry-run]
 set -euo pipefail
 
@@ -46,11 +47,45 @@ fi
 for f in $PUBSPECS; do
   sed -i -E "s/^version: .*/version: $VER/" "$ROOT/$f"
 done
-git -C "$ROOT" add $PUBSPECS
-if git -C "$ROOT" diff --cached --quiet; then
-  echo "pubspecs already at $VER — tagging only"
+
+ORIGIN="$(git -C "$ROOT" remote get-url origin)"
+SERVER="$(echo "$ORIGIN" | sed -E 's#(https?://[^/]+)/.*#\1#')"
+REPO="$(echo "${ORIGIN%.git}" | sed -E 's#.*[:/]([^/]+/[^/]+)$#\1#')"
+PROTO="$(sed -n 's/.*protoVersion = \([0-9]*\).*/\1/p' "$ROOT/packages/core/lib/src/constants.dart")"
+ASSET="watch-together-$VER-linux-x64.tar.gz"
+if [[ -n "$LATEST" && "$LATEST" != "v$VER" ]]; then
+  NOTES="$(git -C "$ROOT" log "$LATEST..HEAD" --format='- %s' | head -n 20)"
 else
-  git -C "$ROOT" commit -m "Release v$VER" -- $PUBSPECS
+  NOTES="Watch together $VER."
+fi
+export MANIFEST_FILE="$ROOT/updates/manifest.json" MANIFEST_VER="$VER" \
+  MANIFEST_PROTO="$PROTO" MANIFEST_NOTES="$NOTES" \
+  MANIFEST_URL="$SERVER/$REPO/releases/download/v$VER/$ASSET"
+python3 - <<'EOF'
+import json, os
+path = os.environ['MANIFEST_FILE']
+try:
+    with open(path) as f:
+        manifest = json.load(f)
+except (FileNotFoundError, ValueError):
+    manifest = {}
+manifest.update({
+    'version': os.environ['MANIFEST_VER'],
+    'protocol': int(os.environ['MANIFEST_PROTO']),
+    'url': os.environ['MANIFEST_URL'],
+    'notes': os.environ['MANIFEST_NOTES'].splitlines()[0] if os.environ['MANIFEST_NOTES'] else '',
+})
+manifest.pop('sha256', None)
+with open(path, 'w') as f:
+    json.dump(manifest, f, indent=2)
+    f.write('\n')
+EOF
+
+git -C "$ROOT" add $PUBSPECS updates/manifest.json
+if git -C "$ROOT" diff --cached --quiet; then
+  echo "everything already at $VER — tagging only"
+else
+  git -C "$ROOT" commit -m "Release v$VER" -- $PUBSPECS updates/manifest.json
 fi
 git -C "$ROOT" tag -a -m "Release v$VER" "v$VER"
 echo "review with: git show v$VER — then: git push --follow-tags"