Release v2.3.0: updates.json mit korrektem xpi-Hash, release.sh Guard-Fix

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

release.sh

@@ -20,7 +20,9 @@ ID="it@hotel-park-soltau.de"
 cd "$(dirname "$0")"
 
 # --- 0. Safety: never publish a build that bundles the local defaults/token ---
-if grep -qa "defaults.local.json" "$XPI"; then
+# Check the archive's file list (not raw bytes — the source references the
+# filename as a string, which would be a false positive).
+if 7z l "$XPI" | grep -q "defaults.local.json"; then
   echo "ABORT: $XPI contains defaults.local.json (your Gitea token!)." >&2
   echo "       Rebuild the .xpi without it before releasing." >&2
   exit 1

updates.json

@@ -5,9 +5,11 @@
         {
           "version": "2.3.0",
           "update_link": "https://git.hotel-park-soltau.de/kendrick.bollens/hps-thunderbird-templates/releases/download/v2.3.0/templates-reply-hotel.xpi",
-          "update_hash": "sha256:ea22d756d6156f865453b90eced7621f34995a1a1115e1e3081b54d1f50b6a75",
+          "update_hash": "sha256:94ca10bb1e35cc8183c4ed2cba640ad06b8cb25273a85d643c8920cfe11158ef",
           "applications": {
-            "gecko": { "strict_min_version": "109.0" }
+            "gecko": {
+              "strict_min_version": "109.0"
+            }
           }
         }
       ]