Add release.sh; make the verify block honest; print the seed script's own revision

Three drifts between this repo and reality, found while moving the per-member key
seed into the app:

- The 'verify after every image deploy' block asserted the CREAM palette
  (rgb(250,248,245)). The deployed palette has been the green wash
  (rgb(234,243,234) with white text areas) for some time, so a correct deploy
  would have read as a failure — and invited someone to 'fix' the CSS back.
- The block still verified against librechat-test.inference.coop; the swap to
  chat.inference.coop happened 2026-10-21 and that alias is not provisioned.
- Nothing checked that the scheduler task's script exists in the running image,
  which is exactly the failure mode a manifest repoint can introduce.

release.sh encodes the documented release flow (dirty-tree guard, always
--no-cache, pin-before-deploy) and its verify subcommand runs checks 1-5 plus the
seed task's log lines. sync-keys.js now prints its own md5 prefix on every run,
so a stale volume copy can never hide again — the repo copy's md5 is the
authority.

Verified: ./release.sh verify passes all six checks against the live app;
./release.sh volume sync-keys.js confirms md5 parity.

sync-keys.js

@@ -53,6 +53,15 @@ const MONGO_URL = process.env.CLOUDRON_MONGODB_URL || process.env.MONGODB_URL;
 const PORTAL_URL = process.env.PORTAL_URL || "https://portal.inference.coop";
 const SYNC_TOKEN = process.env.LIBRECHAT_SYNC_TOKEN || "";
 const ENDPOINT_NAME = "Inference Co-op";
+
+// Which revision is actually running? The script lives on the persistent volume,
+// so it can be pushed out of band; printing its own hash on every run means a
+// stale copy can never hide — compare this with `md5sum sync-keys.js` in the repo.
+const SELF_HASH = (() => {
+  try {
+    return require("crypto").createHash("md5").update(fs.readFileSync(__filename)).digest("hex").slice(0, 8);
+  } catch (e) { return "unknown"; }
+})();
 const MCP_PLUGIN_KEY = "mcp_inference-image" // Constants.mcp_prefix is "mcp_" (underscore), not "mcp:";
 const MCP_AUTH_FIELD = "IC_API_KEY";
 
@@ -129,6 +138,7 @@ const mongoose = require("/app/code/librechat/node_modules/mongoose");
   console.log(`creds check: ${credsCheck} (${sample.length} existing row(s))`);
 
   let seeded = 0, skipped = 0;
+  console.log(`sync-keys.js revision ${SELF_HASH} (repo copy md5 starts with this)`);
   for (const m of members) {
     const email = String(m.email || "").toLowerCase();
     const sk = String(m.key || "");