fix: the file the gate passed is the file published, and stable takes only the approved one

tools/release-gate.sh is the one gate: a fresh install, and the upgrade
from what canary and stable serve, each on a room of that channel, plus
any older release rooms are still on (RELEASE_GATE_FROM). The releases it
upgrades from are fetched over HTTPS and checked against their manifests,
so it needs no credential and a CI runner can run it.

update_canary.sh VERSION PACKAGE gates and publishes that file without
rebuilding it, since a second build is a second, untested file; the hash
is taken before the gate and checked after it. update_stable.sh VERSION
SHA256 refuses anything but the file that was approved.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

update_stable.sh

@@ -9,7 +9,23 @@ source "$ROOT/tools/release-lib.sh"
 # Stable never gets a package of its own. It is pointed at one canary
 # already published, so the file every classroom downloads is byte for
 # byte the one the canary machine ran.
-if [[ $# -eq 1 ]]; then
+#
+#   ./update_stable.sh VERSION SHA256   the release that was approved, by
+#                                       the checksum it was approved as
+#   ./update_stable.sh VERSION          the release, whatever file it is
+#   ./update_stable.sh                  whatever canary is on
+#
+# With SHA256, anything but that exact file is refused. The checksum is
+# the one written down when the release went to canary and passed its
+# physical checks, so the approval and the promotion name the same bytes.
+expected_hash="${2:-}"
+
+if [[ -n "$expected_hash" && ! "$expected_hash" =~ ^[0-9a-f]{64}$ ]]; then
+    echo "Not a SHA-256 checksum: $expected_hash" >&2
+    exit 1
+fi
+
+if [[ $# -ge 1 ]]; then
     version="$1"
 else
     if [[ ! -f "$RELEASE_LOCAL/canary/manifest.json" ]]; then
@@ -50,6 +66,13 @@ fi
 
 hash="$(sha256sum "$package_path" | awk '{print $1}')"
 
+if [[ -n "$expected_hash" && "$hash" != "$expected_hash" ]]; then
+    echo "$package_name is not the file that was approved:" >&2
+    echo "  approved: $expected_hash" >&2
+    echo "  here:     $hash" >&2
+    exit 1
+fi
+
 echo "Promoting $version to STABLE (from ${current:-nothing})"
 
 # Refuses unless the server already holds exactly this package.