Distribution: itch installer, inbuilt updater, R2 static content (plan from #223) nf-ldba ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/268 by tools/beads/import_github.py's reconcile pass.

> 🔒 Claimed by the distribution chat session (workstation, 2026-07-27). Other Claude sessions: do not pick this issue up from the poll loop — PRs for it are coming from the session that filed it.

Concrete plan to get distribution fully sorted, per the decisions in [discussion #223](https://github.com/cfsh/ninefold/discussions/223) ([summary comment](https://github.com/cfsh/ninefold/discussions/223#discussioncomment-17792131)): itch (secret URL) for the public installer download, Cloudflare R2 for static content (manifests, update files, later sample packs), no code signing for now, Supabase stays dedicated to Wavelet EDU.

Existing infra this builds on (mostly #166): installer/ is already a controller-friendly Godot updater — manifest fetch, sha256 diff sync, hash-verified downloads, stale-file cleanup, UDP LAN discovery, and rename-swap self-update. tools/gen_manifest.py generates the manifest; server/ is the LAN dev server + beacon. The work below is largely "point that machinery at the internet", not greenfield.

PR 1 — Installer exports + itch upload

• [ ] Add Windows export preset for the game and export presets for installer/ (currently only a Linux game preset exists in export_presets.cfg).
• [ ] Installer default/fallback URL becomes the R2 base URL instead of the LAN placeholder (http://192.168.1.100:8000/ninefold). UDP discovery stays as the LAN fast path — beacon reply found → LAN; no reply → R2. Config gains the {baseUrl, token?} shape from #223 (token optional, sent as a header if present).
• [ ] Build installer binaries: Windows + Linux single-file exports. macOS: defer unless the neighbour actually runs one — unsigned/un-notarized Mac apps fight Gatekeeper hard enough that itch-app-or-nothing is the realistic Mac story.
• [ ] butler push the installer builds to aedanpope/ninefold channels (windows, linux). Verify the page downloads work, visibility = restricted/secret URL, and add the one-line SmartScreen note ("More info → Run anyway") to the page.
• [ ] Retire static/install-ninefold.sh once the Linux installer build covers the Steam Deck flow (it's the pre-#166 bootstrap).

PR 2 — Inbuilt updater in the game (supersedes the installer's updater role)

• [ ] Port the manifest-sync logic into the game as pure C# (HttpClient, not Godot HttpRequest) so it's unit-testable under shared/ per repo conventions. The installer's Installer.cs logic is the reference implementation.
• [ ] On launch: async manifest check against {baseUrl, token?} (+ LAN beacon fast path). Update available → controller-friendly in-game prompt → download to staging (hash-verified) → rename-swap the game files (.exe/.pck/assemblies — rename-aside is legal on a running exe and doubles as rollback) → relaunch. Include an update-while-second-instance-running guard.
• [ ] Steam-pinned experience is the design constraint: the kids launch via a Non-Steam shortcut, so the exe path must never move (swap strictly in place), no separate updater window, and the relaunch must keep Steam overlay / Steam Input attached (relaunched process is a child of the one Steam started — verify this holds in Big Picture; if it doesn't, fall back to "staged download during play, apply at next launch").
• [ ] After this lands, the standalone installer is first-install bootstrap only — its "Check again" update role is obsolete. Slim it or leave it dormant; decide in review.

PR 3 — Release pipeline → R2 + itch

• [ ] tools/release/ script: headless Godot export (game + installer) → gen_manifest.py → sync manifest + files to the R2 bucket (rclone or wrangler, R2 is S3-compatible) → butler push installer to itch. One command from a clean checkout.
• [ ] Manifest layout on R2 keeps the existing gen_manifest.py format so the LAN server and R2 serve identical content; the client transport is the only variable.
• [ ] Document the release flow in the repo (README or tools/release/README.md).

Setup (Aedan — blockers for PR 1/3 verification)

• [ ] Create the R2 bucket in the existing Cloudflare account + an API token scoped to Object Read & Write on that bucket. Neither machine currently has any Cloudflare tooling or credentials (checked the workstation: no wrangler/rclone/aws, no CLOUDFLARE_API_TOKEN).
• [ ] itch.io API key (itch.io → Settings → API keys) for headless butler push on the sandbox box. butler v15.29.0 is already installed on the workstation (C:\Tools\butler, on PATH) — run butler login there once.

Later / out of scope here

• Sample-pack index on R2 (decoupled pack downloads into user://) — the checksum-keyed CDN plan; separate issue when wanted.
• Expiring signed URLs / permissions — R2 presigned URLs are a config change when needed; nothing to build now.
• Code signing — revisit only if distribution widens (AU individuals are locked out of Azure Artifact Signing; see the #223 comment).

PRs will land stacked where they touch the same files, per the normal workflow. Refs #166.