release: publish sl0ppi.sl0p.foo, and a script to keep it current

Phase 5, settled as build scripts rather than CI:

  make release   tests, then a fresh static-musl tarball
  make publish   render the site, upload, and verify against the live URL

publish.sh is deliberately dumb -- rsync, then ask the live site whether it
agrees (status codes plus a re-downloaded checksum) -- but it has two guard
rails that matter:

  - it refuses to republish a version whose bytes differ from what is already
    live. /releases/ is cached for a year, so the same URL serving two different
    tarballs would be undebuggable. Bump VERSION instead.
  - artifacts upload before latest.json, so the pointer never names a file that
    is not downloadable yet.

site/install.sh is POSIX sh and short on purpose, because people are being asked
to pipe it into a shell. It reads latest.json, downloads the versioned artifact,
VERIFIES ITS SHA256, and only then unpacks and runs the bundled installer.
Refusal was tested for real by serving a doctored latest.json: it stops with a
checksum mismatch and installs nothing.

Verified end to end from the public URL, in a throwaway HOME with node, npm,
bun, cargo and rustc replaced by poison stubs:

  curl -fsSL https://sl0ppi.sl0p.foo/install.sh | sh
  sl0ppij --version -> 0.45.0+sl0p1
  pi --version      -> 0.84.1
  sl0ppi doctor     -> all good

The vhost itself is committed in the sl0pday repo, where that box's nginx config
lives.

0 files changed, 0 insertions, 0 deletions