Add signed updates from a bundle or a URL

router-release signs a release as a binary cache; router-update verifies
it against the router's update keys, migrates settings.json, and applies
it with commit-confirm. Includes the web UI page and a VM test.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

scripts/release.sh

@@ -0,0 +1,30 @@
+# Signs $release (a store path) as a binary cache and writes, into --out:
+#   router-update-<version>.bundle   one file to upload in the web UI
+#   latest, cache/                   the same, laid out for `router pulls from a URL`
+# usage: router-release --key KEYFILE [--out DIR] [--compression zstd|none]
+key=""
+out=dist
+compression=zstd
+while [ $# -gt 0 ]; do
+  case $1 in
+    --key) key=$2; shift ;;
+    --out) out=$2; shift ;;
+    --compression) compression=$2; shift ;;
+    *) echo "usage: router-release --key KEYFILE [--out DIR] [--compression zstd|none]" >&2; exit 2 ;;
+  esac
+  shift
+done
+[ -n "$key" ] && [ -r "$key" ] || { echo "router-release: --key needs the secret key file (nix key generate-secret)" >&2; exit 1; }
+
+mkdir -p "$out"
+out=$(realpath "$out")
+version=$(cat "$release/version")
+rm -rf "$out/cache" "$out/latest"
+nix --extra-experimental-features nix-command copy --to "file://$out/cache?secret-key=$(realpath "$key")&compression=$compression" "$release"
+jq -n --arg release "$release" --arg version "$version" \
+  --argjson serial "$(cat "$release/serial")" --argjson schema "$(cat "$release/schema")" \
+  '{release: $release, version: $version, serial: $serial, schema: $schema}' > "$out/latest"
+tar -C "$out" -cf "$out/router-update-$version.bundle" latest cache
+echo "release $version ($(du -h "$out/router-update-$version.bundle" | cut -f1)):"
+echo "  upload  $out/router-update-$version.bundle  in the router's web UI (Update)"
+echo "  or serve $out over HTTP(S) and give the router that URL"