DumbCode v0.12.3 — self-healing upgrade + branding

Fix: upgrade self-heal

The v0.12.2 upgrade had a nasty bug: the asset picker matched any .exe, and GitHub lists release assets alphabetically — so it downloaded dumbcode-setup.exe (the net installer) and swapped it over your real CLI. Symptom: dumbcode --version printed the setup banner instead of a version.

This release fixes the updater and lets broken installs repair themselves:

• pickAsset now explicitly prefers dumbcode.exe and skips *-setup / installer names
• The Windows swap finisher is hardened: verifies the staged exe, waits headless-safe, retries through AV file locks, and on failure keeps the staged exe + writes <target>.update-failed.txt instead of vanishing silently
• New command: dumbcode repair — detects a setup-binary masquerading as the CLI, downloads the release CLI, verifies its SHA-256 against SHA256SUMS.txt, and swaps it in safely

If your install is broken (prints "DumbCode setup" on --version)

npm i -g dumbcode        # option A: reinstall via npm
# or download this release's dumbcode.exe and replace the installed one

(Existing broken installs from v0.12.2's updater can't run dumbcode repair themselves — the binary is the installer. Run the installer: it now refuses self-overwrite and installs the correct CLI.)

Also

• Branding generator (scripts/gen-branding.mjs): zero-dependency PNG renderer producing the DumbestBOT avatar, banner, and social-preview art
• Docs: org profile for DumbestBOT (the live GitHub App bot)

Verification

• 127/127 tests pass (2 new covering the asset picker and finisher hardening)
• dumbcode.exe reports v0.12.3; SHA256SUMS included