2026.10.3

All pre-built binaries passed smoke test.

Installing (and the nvim-plugin-stash.tar.bz2 asset)

The Neovim plugin stash ships as a separate release asset, not inside the
source tarball -- it is ~328 MB of bz2'd git packfiles, so committing it would
grow every clone permanently. Download it alongside the tarball and pair them:

tar xzf engineering-loadout-*.tar.gz
cd engineering-loadout-*/

# online: fetches + verifies the stash from this release
./tools/fetch-stash

# air-gapped: stash + sha256sums.txt downloaded elsewhere and copied over
./tools/fetch-stash --from-file /path/to/nvim-plugin-stash.tar.bz2 \
              --sums     /path/to/sha256sums.txt

./loadout install @shared-all      # bundled tools
./loadout install @envs-all        # per-user shell configs

Run fetch-stash from inside the extracted directory; it places the stash at
envs/nvim/vendor/plugins/nvim-plugin-stash.tar.bz2 and records it in .content-manifest.fetched.

--sums is required with --from-file: without the sha256sums.txt from this
same release there is nothing to verify against, and a stash that fails its hash is
deleted rather than left on disk. Do not copy the asset into place by hand --
.content-manifest is a strict allowlist and the installer refuses any payload file
with no manifest entry, so a hand-placed stash is rejected, not silently trusted.

Without the stash, Neovim still installs and starts; the plugin step is skipped with
a warning naming fetch-stash.

Asset checksums (SHA-256)

Integrity-critical files pinned by this release. .content-manifest in turn pins every payload file, so verifying it (or running ./loadout doctor --verify) covers the whole tree.

File	SHA-256
.content-manifest	fe8e55aeef66a381c15fc8abef605492170831bdce1edd91822b8f94d06f2cee
loadout	c72bdcc7863d7e73da499d4bcdb61c4f4fa6f8e4edbaab6472e48c6fde9c15f4
loadout_main.py	1b4a3c527f8f6a179ce20b8faec4b055014b9581ca10ca1feb61c265f63763b3
payload/packages.json	828a7aab124b686ddfc8a5569dcc7de7994415bdd9b5266e126cc10f608bbf98
envs/nvim/vendor/plugins/nvim-plugin-stash.tar.bz2	28a5ad38ccd430d09e15e47ff2de09945f6f1b68111f93f706e8b9e4e4bc0e30
sbom.cdx.json	e44011f718e781410326c89f8c7e85d520f0c3e4bcc99a61a3cd2d4c1c6b68d1

SBOM

sbom.cdx.json (CycloneDX) inventories the shipped closure: every Python wheel
(syft), the offline Rust crate store, and every registry package. Its SHA-256 is
in the checksums table above, so the signed tag binds it like any other asset.

Verifying this release

# from a checkout of the tag (or an extracted source archive):
sha256sum -c sha256sums.txt     # pins the integrity-critical files above
./loadout doctor --verify       # re-hashes every payload file vs .content-manifest
git tag -v 2026.10.3                # verify the SSH-signed tag