Simplify release DX: local manifest, optional hash, slimmer publish

release.sh writes updates/manifest.json at release time (predictable
asset URL) — no CI commit-back, no push-token problem, no detached
checkout dance. release_publish.sh is create-release + upload only.
Manifest sha256 now optional; updater skips verification with a note
when absent (HTTPS + gzip CRC cover the realistic cases). Fixed the
repo-URL sed keeping a .git suffix (caught by a worktree dry run).
Updater tests: 8 (sha-less manifest flow added).

updates/manifest.example.json

@@ -2,6 +2,5 @@
   "version": "0.2.0",
   "protocol": 4,
   "url": "https://git.senkochan.moe/Foxyz/sync_replay_project/releases/download/v0.2.0/watch-together-0.2.0-linux-x64.tar.gz",
-  "sha256": "<sha256 of the tarball, filled in at release time>",
   "notes": "One-line highlight of what changed."
 }