git:20261102.ea98d13 to git:20261103.c889b97

4 added, 3 removed. Audit A to A.

# KDock repository rules

## Versioning

- Never hand-edit the application version in `package.json`, `Cargo.toml`, `package-lock.json`, or `src-tauri/tauri.conf.json`.

- - `npm run tauri build` must be the packaging entry point. `scripts/tauri-entry.mjs` runs Semifold before Tauri starts, because Tauri reads `tauri.conf.json` before `beforeBuildCommand`.

- - `beforeBuildCommand` verifies the marker set by that wrapper. Direct `npx tauri build`, cargo packaging, or another Tauri entry point must fail instead of producing an unbumped package.

- - CI runs `smif version` during packaging and commits the generated version/changelog changes back to `main` after a successful build.

+ - `npm run tauri build` must be the packaging entry point. Local builds package the current version without modifying version files.

+ - Official release builds set `KDOCK_RELEASE_BUILD=1`. `scripts/tauri-entry.mjs` then runs Semifold before Tauri starts, because Tauri reads `tauri.conf.json` before `beforeBuildCommand`.

+ - `beforeBuildCommand` verifies the marker set by that wrapper. Direct `npx tauri build`, cargo packaging, or another Tauri entry point must fail.

+ - CI sets `KDOCK_RELEASE_BUILD=1`, runs `smif version`, and commits the generated version/changelog changes back to `main` after a successful build.

- Use `scripts/semfold-version.ps1 -DryRun` to preview a release without changing files.

- Do not bypass the Semifold flow with `cargo build --release` when producing a distributable package.

## Update manifest

- `release/kdock-update.json` is generated by `scripts/release-manifest.mjs` in CI and uploaded with the rolling `test-latest` release.

- The startup updater accepts installer URLs only from the KDock GitHub Release, downloads to app-local storage, verifies the manifest SHA-256, and never installs without explicit user confirmation.