Records the two release-process traps for the next cut: the manifest is committed before signing (so the fleet would refuse the OTA), and gitea-vps2 is the same server as gitea-ai with a dead token. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>