Add release.sh; make the verify block honest; print the seed script's own revision

Three drifts between this repo and reality, found while moving the per-member key
seed into the app:

- The 'verify after every image deploy' block asserted the CREAM palette
  (rgb(250,248,245)). The deployed palette has been the green wash
  (rgb(234,243,234) with white text areas) for some time, so a correct deploy
  would have read as a failure — and invited someone to 'fix' the CSS back.
- The block still verified against librechat-test.inference.coop; the swap to
  chat.inference.coop happened 2026-10-21 and that alias is not provisioned.
- Nothing checked that the scheduler task's script exists in the running image,
  which is exactly the failure mode a manifest repoint can introduce.

release.sh encodes the documented release flow (dirty-tree guard, always
--no-cache, pin-before-deploy) and its verify subcommand runs checks 1-5 plus the
seed task's log lines. sync-keys.js now prints its own md5 prefix on every run,
so a stale volume copy can never hide again — the repo copy's md5 is the
authority.

Verified: ./release.sh verify passes all six checks against the live app;
./release.sh volume sync-keys.js confirms md5 parity.

README.md

@@ -1,9 +1,11 @@
 # LibreChat sandbox — Inference Co-op customization
 
-Source of truth for the LibreChat evaluation instance at
-**librechat-test.inference.coop** (Cloudron app `4023ccbf-d57a-4500-97df-14de9cf3516e`,
+Source of truth for the co-op's chat instance at
+**chat.inference.coop** (Cloudron app `4023ccbf-d57a-4500-97df-14de9cf3516e`,
 appstore package `ai.librechat.cloudronapp@1.4.1`, which bundles **LibreChat
 v0.8.8** on image `cloudron/ai.librechat.cloudronapp:202610150224320000`).
+`librechat-test.inference.coop` was the pre-swap hostname (the swap to
+`chat.` happened 2026-10-21; the test alias is still not provisioned).
 
 The deployment has **two independent layers** — know which one you are changing:
 
@@ -32,6 +34,7 @@ md5sum librechat.yaml mcp/server.py mcp/image_server.py
 | Env vars (env-file wins!) | `/app/data/env` (volume, sourced LAST by start.sh) | yes | documented below |
 | Env vars (Cloudron-managed) | `cloudron env` (process env) | yes | documented below |
 | MCP servers | `/app/data/mcp/server.py` + `mcp/image_server.py` (volume) | yes | `mcp/` |
+| Per-member key seed | `/app/data/sync-keys.js` (volume; run by the manifest's `scheduler` task) | yes | `sync-keys.js` |
 | Brand assets + branding CSS/JS | baked into image overlay | no — rebuilt per image | `assets/` |
 | `CloudronManifest.json` | repo only (controls what `cloudron update` deploys) | n/a | official appstore manifest **except `dockerImage`** |
 
@@ -114,6 +117,13 @@ cloudron --server my.inference.coop --token "$CLOUDRON_TOKEN" update \
   --app 4023ccbf-d57a-4500-97df-14de9cf3516e --force
 ```
 
+`./release.sh release` runs this same sequence with both traps handled — it
+refuses to build from a dirty tree, always passes `--no-cache`, writes the tag
+into the manifest before deploying, then runs the verification block. `build`
+needs docker, so it runs on whoever's machine has it (deliberately not the agent
+VM); `verify`, `volume` and `pin`/`deploy` need only `CLOUDRON_TOKEN`.
+`./release.sh verify` is safe to run any time.
+
 Rollback: repoint `CloudronManifest.json.dockerImage` to the previous tag
 (every build is tagged `20261019-<git-sha>`; the base image
 `cloudron/ai.librechat.cloudronapp:<tag>` is the pre-overlay fallback) and
@@ -132,12 +142,24 @@ cloudron --server my.inference.coop --token "$CLOUDRON_TOKEN" exec --app $APP \
   -- md5sum /app/code/librechat/client/dist/assets/custom.css
 md5sum assets/custom.css
 # 3. Served HTML carries the injection
-curl -s https://librechat-test.inference.coop/login | grep -Eo 'assets/custom2?\.js|assets/custom\.css'
-# 4. Rendered DOM shows it (browser devtools or a browser tool):
-#    computed background of div.bg-surface-primary == rgb(250, 248, 245);
-#    the "Don't have an account?" <p> computes display: none.
+curl -s https://chat.inference.coop/login | grep -Eo 'assets/custom2?\.js|assets/custom\.css'
+# 4. Rendered DOM shows it (browser devtools or a browser tool). The DEPLOYED
+#    palette is the GREEN WASH with white text areas — an earlier version of this
+#    block asserted cream (rgb(250,248,245)), which would have led you to "fix"
+#    a correct deploy:
+#      computed background of div.bg-surface-primary == rgb(234, 243, 234);
+#      chat text areas / composer == rgb(255, 255, 255);
+#      dark scheme == rgb(34, 39, 31);
+#      the "Don't have an account?" <p> computes display: none.
+# 5. The scheduler task's script exists in THIS image — a manifest repoint
+#    deployed before its image lands leaves the key seed broken on schedule:
+cloudron --server my.inference.coop --token "$CLOUDRON_TOKEN" exec --app $APP \
+  -- test -f /app/data/sync-keys.js && echo "seed path present"
 ```
 
+`./release.sh verify` runs checks 1-5 plus the seed task's own log lines and the
+running script's revision hash, and exits non-zero on any failure.
+
 ### `CloudronManifest.json` rules
 
 - The **only** field you may change is `dockerImage` — it must point at the