contrib/manifest/generate.py + pre-commit hook; install-git-hooks.sh creates .local/build-release-manifest.sh (gitignored). Remove scripts/ from remote.
Pinned GIT_REF/verify, release manifest, no blind reset --hard; suppress lifecycle and watchdog Telegram during updater; healthcheck via json.dumps.