Verify decrees, never strand an operator, and start in seconds

[hotpixelgroup]

Three of the five improvements. Notarisation and Windows deliberately excluded.

1. The silent update dead-end — a real defect

Both the installer and the app updated with merge --ff-only, and the app
swallowed the failure into a log nobody reads. A node that has been vibed even
once has diverged, so every engaged user silently stopped receiving updates
forever — security fixes included. The more someone used the product, the more
stranded they became.

The console now owns updating: it reports what upstream has and replays the
operator's decrees on top with a rebase. Conflicts abort cleanly, name the code
upstream also touched, and leave the node exactly as it was.

A dirty working tree is now reported as itself rather than blamed on upstream —
an interrupted decree leaves precisely that state, and sending someone hunting an
imaginary conflict would be worse than saying nothing.

Verified on a diverged clone: 1 commit behind with 3 decrees → absorbed, decrees
replayed in order, behind back to 0.

2. Decrees are verified, not merely compiled

Compiling proves the code is grammatical, not that it is still a Bitcoin node.
Every build is now checked in a throwaway regtest datadir — mine 101 blocks, read
the chain, confirm it still rejects impossible amounts — before it becomes the
node the operator runs. On failure the old binary keeps running and the console
says so plainly.

Found a bug in the checker while testing it: bitcoind rejects -port=0 outright,
so the probe never started. Passes in 3s on a good binary.

3. A node in seconds, not minutes

First run meant a 5-to-90 minute compile before anything happened. A compiler is
only needed to vibe, not to run, so the installer and console now fetch a
published binary and defer the real build to the first decree.

release.yml builds for macOS arm64/x86_64 and Linux x86_64 on tag, proves each
validates before publishing, and records its source commit. That commit check is
the point: a binary built from other source is not the node you are about to
edit. Verified both directions against a locally served release — mismatch
refused with both hashes named, match accepted and the binary confirmed runnable.

Checklist

• I ran it
• python3 -m py_compile contrib/vibes/bitcoin-vibes
• sh -n on installer and launcher
• UI: update banner is a role="status" live region, renders at 375px
• src/ touched? No — consensus untouched, fresh install still stock Core

Note

The release workflow itself cannot be fully exercised until a tag is pushed; the
installer and console halves of it are verified locally as described.