App updates

An app update replaces just the application, in seconds, with no reboot.

What happens

1. The box reads the signed manifest and sees a newer version on its channel.
2. It downloads the self-contained app package (a per-architecture tarball, or — in Docker — the pinned container image) and verifies its SHA-256 against the signed manifest.
3. It stages the new version alongside the current one, then repoints current and restarts the unit.
4. If the new version doesn’t come up healthy, it reverts.

Where it comes from

• Appliance / native: a linux-arm64 / linux-x64 tarball listed in the manifest’s packages.
• Docker: the image pinned by digest in the manifest (ghcr.io/redth/remaestro@sha256:…).

Because the artifact is published once and the manifest only ever points at it, promoting a build between channels can never hand you a different binary than the one that was tested.