Release v2.3.0: updates.json mit korrektem xpi-Hash, release.sh Guard-Fix

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

release.sh

@@ -20,7 +20,9 @@ ID="it@hotel-park-soltau.de"
 cd "$(dirname "$0")"
 
 # --- 0. Safety: never publish a build that bundles the local defaults/token ---
-if grep -qa "defaults.local.json" "$XPI"; then
+# Check the archive's file list (not raw bytes — the source references the
+# filename as a string, which would be a false positive).
+if 7z l "$XPI" | grep -q "defaults.local.json"; then
   echo "ABORT: $XPI contains defaults.local.json (your Gitea token!)." >&2
   echo "       Rebuild the .xpi without it before releasing." >&2
   exit 1