0.2.4

• Playwright/Chrome-for-Testing archives are republished as sha256-pinned
  GitHub release assets (.github/workflows/vendor-playwright.yml); the
  agent browser install falls back to them automatically when Google's
  CfT CDN geo-blocks a server's IP (403 "not available in your location"
  on some Hetzner/Scaleway ranges), serving them to Playwright from a
  loopback HTTP server so its own installer logic runs unchanged. See
  vendors/README.md.
• Every version pin now lives in one manifest, embedded by the backend
  (backend/internal/agent/provisioning/versions.env) and symlinked at
  infra/versions.env: agent CLIs, Node, Go, code-server, Playwright/CfT
  and the vendor sha256 pins. agent-cli-versions.env is merged into it;
  the code-server version and NodeSource major are substituted from the
  manifest instead of being hardcoded in scripts.
• Command-transcript truncation keeps the tail instead of the head
  (output.TruncateTail at every call site): install errors sit at the
  end of the output and were being cut away, twice hiding a build's real
  failure.
• The Playwright install step no longer masks its exit status behind a
  tail pipe; both download paths failing now reports a clear, actionable
  error instead of a bare exit status 2.
• Removed .github/workflows/installer.yml (zero runs ever; its hardcoded
  PUBLIC_HOSTNAME could flip the live domain as a side effect) and
  corrected CONTRIBUTING.md + deploy.yml docs: infra changes reach boxes
  via infra/update.sh or the in-app updater, both of which preserve each
  box's hostname.