Manifest was hashed from Windows working tree while Linux checkout uses git blobs; verify failed with sha256 mismatch. build-release-manifest.sh now hashes :index/HEAD; .gitattributes enforces LF for agent scripts.
Pinned GIT_REF/verify, release manifest, no blind reset --hard; suppress lifecycle and watchdog Telegram during updater; healthcheck via json.dumps.