Read the release manifest: verify, parse, decide, cache

[onel]

Closes #395.

The apply transaction (#385) and its trigger (#386) are both built, and nothing picks the target — POST /api/v1/system/update takes two image refs an admin typed. On an appliance the target comes from a signed release manifest (RELEASE_MANIFEST.md). This is the half of that with no network and no timer in it: verify, parse, decide, cache. The poll, the dashboard prompt and the three-strikes pin are later slices, and each is easier with this part pure and tested.

The verifier takes both minisign algorithm modes (Ed over the file, ED over its BLAKE2b-512) and checks both signatures in the file. The second one covers the signature plus the trusted comment — skipping it would let anyone rewrite that comment on a genuinely signed file, and the caller would get attacker-chosen text that looks authenticated.

Keys are a list from day one. RELEASE_MANIFEST.md # Signing builds rotation on it, and one constant would turn a lost key into a synchronized fleet update. Zero keys refuses everything — that is the shipping state today, since no signing key exists yet, so the appliance updater stays inert rather than acting on a file it cannot check.

Decide answers four states, not two. "Valid and current, but this box's host-agent is too old" is a healthy box waiting on its apt update, not a manifest to ignore, so it stays distinct from "not for you". The kill switch is checked before the host-agent gate: a box already running a retracted version should be offered the way back even when it is behind, because the gate exists to stop it moving forward. An unparseable version fails closed.

The cache stores the publisher's raw bytes, because a re-marshal drops the unknown fields Parse ignores and could never verify again, and Load re-verifies so the local file system is not a way around the signature.

Testing. Table tests over the failure modes the spec names, driven by a small minisign signer in the test file so the parser meets bytes in minisign's real layout. Four mutation checks, each done by editing the code and restoring it: drop the global-signature check (only the trusted-comment test fails), prehash the wrong mode, treat an unreadable version as new enough, skip the re-verify in Load.

Two things this does not fix, recorded in the progress entry rather than glossed over: no box has a signing key, so this is proven against test-generated keys only; and turning a version into an image digest is still undecided — the manifest names versions, the transaction pulls by digest, and the published ghcr packages are still private per BUILD.md # 6.

Progress entry: docs/progress/release-manifest-read.md. make test-nopam green; gofmt clean; no API surface touched.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
internal/hostagent/relmanifest/cache.go	Stores the manifest and signature in one atomically replaced envelope, resolving the previously reported split-pair failure.
internal/hostagent/relmanifest/manifest.go	Implements manifest validation and semver-aware update, rollback, hold, and no-op decisions.
internal/hostagent/relmanifest/minisign.go	Implements minisign key parsing and verification of both primary and trusted-comment signatures.
internal/hostagent/relmanifest/relmanifest_test.go	Covers signature failures, manifest decisions, cache verification, and whole-pair cache replacement.

_{Reviews (2): Last reviewed commit: "Review fixes: one cache file, and compar..." | Re-trigger Greptile}