release: v1.5.0-alpha + version hygiene fixes

Versioning was drifting on three axes — fixed all of them:

1. Cargo.toml → 1.5.0-alpha (was 1.5.0). User wants `-alpha` suffix
   on every pre-stable release; this is the current state of main.
2. neode-ui/package.json was still 1.3.5 — brought in line.
3. /opt/archipelago/build-info.txt was stale on .198 (1.3.4) and
   .253 (1.3.5), absent on .116/.228. That file OVERRIDES the
   binary's CARGO_PKG_VERSION for the UI sidebar, which is why
   .198/.253 kept showing old versions even with fresh binaries.
   scripts/deploy-to-target.sh now writes build-info.txt on every
   deploy, reading the version straight from Cargo.toml — so the
   sidebar can never drift from the binary again.

Release artifacts + manifest:
- releases/v1.5.0-alpha/archipelago (40M, sha in manifest)
- releases/v1.5.0-alpha/archipelago-frontend-1.5.0-alpha.tar.gz (51M)
- releases/manifest.json bumped with full 7-line changelog covering
  FIPS-first routing, Settings toggle, transitive federation, cancel
  button, transport badges, peer listener, and the build-info fix.
- scripts/check-release-manifest.sh — new pre-publish guard. Refuses
  to pass if: Cargo.toml ≠ manifest version, changelog is empty
  (release notes are mandatory), or any component's sha256/size
  doesn't match the file on disk. Run locally or from CI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

releases/manifest.json

@@ -1,29 +1,31 @@
 {
-  "version": "1.4.0",
+  "version": "1.5.0-alpha",
   "release_date": "2026-04-19",
   "changelog": [
-    "FIPS mesh transport integrated (github.com/jmcorgan/fips): preferred over Tor for peer traffic",
-    "Seed-derived FIPS identity via HKDF label archipelago/fips/secp256k1/v1",
-    "Federation invites carry an optional fips_npub so peers can reach each other via FIPS",
-    "Network tab surfaces FIPS daemon version + copyable npub; Home shows FIPS status line",
-    "WiFi SSID now shown on Network tab when connected (was N/A)"
+    "FIPS-first transport for federation, messaging, peer linking, and file sharing — Tor stays as automatic fallback",
+    "Per-service transport preference Settings card (Auto / FIPS / Tor) per node-to-node surface",
+    "Transport badge (FIPS / TOR / LAN / MESH) on every federated node card, reflecting the transport actually used on the last reach",
+    "Transitive federation — accepting one peer automatically learns their trusted peers (one hop) so subsequent syncs go over FIPS directly",
+    "Cancel button for outbound pending peer requests: withdraws locally and notifies the recipient to drop their inbound row",
+    "Dedicated FIPS peer listener bound to fips0 ULA on port 5679 with a path whitelist (only signed endpoints are reachable from the mesh)",
+    "Deploy script now writes /opt/archipelago/build-info.txt on every deploy so the UI sidebar version never drifts from the binary again"
   ],
   "components": [
     {
       "name": "archipelago",
-      "current_version": "1.3.5",
-      "new_version": "1.4.0",
-      "download_url": "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/v1.4.0/archipelago",
-      "sha256": "f42b03622ea47b953f5961a364cdfd1c354f21456dff7ec26594af4150c4976d",
-      "size_bytes": 37714624
+      "current_version": "1.4.0",
+      "new_version": "1.5.0-alpha",
+      "download_url": "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/v1.5.0-alpha/archipelago",
+      "sha256": "b7527e53b373aba05013b35750f890e5f98c91be542cbe406fa55216cb6a6acc",
+      "size_bytes": 40020488
     },
     {
-      "name": "archipelago-frontend-1.4.0.tar.gz",
-      "current_version": "1.3.5",
-      "new_version": "1.4.0",
-      "download_url": "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/v1.4.0/archipelago-frontend-1.4.0.tar.gz",
-      "sha256": "100388985b98ab1adab191a23dd7a197f9a6c45c743da39f9df99d0213880086",
-      "size_bytes": 76984287
+      "name": "archipelago-frontend-1.5.0-alpha.tar.gz",
+      "current_version": "1.4.0",
+      "new_version": "1.5.0-alpha",
+      "download_url": "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/v1.5.0-alpha/archipelago-frontend-1.5.0-alpha.tar.gz",
+      "sha256": "83fbacf3b0ba237cd78cc0be798f7d74d8aea5d62110a1eb6ecdc56f77cf505e",
+      "size_bytes": 53359792
     }
   ]
 }