PR-Review #103: checksum filename drifts between build script and download guides

[Sev7eNup]

Automated review finding for PR #103 — "Make NodePilot installable from outside, and cut 1.0.1"
Author: @Sev7eNup · Status: merged

The PR is otherwise strong: the C# changes (version-from-assembly, unreachable-DB message, config hygiene) are small, correct, and each ships a real test (CliVersionTests, the Bootstrap_UnreachableDatabase_* test, AppSettingsHygieneTests); the signing-before-checksums ordering is pinned by a code-anchored contract in Test-DeploymentTemplates.ps1; no new API endpoint (so no CLI/MCP obligation) and no user-facing SPA strings changed (so no DE+EN gap). One consistency gap rises to medium:

• [medium] deploy/Build-Artifact.ps1:104 vs README.md:197, docs/deployment-guide.md:88/94, deploy/README.md:206 — The build emits the checksum file as NodePilot-<version>.SHA256SUMS.txt, and the build/verify-your-own-build docs reference exactly that name — but every download instruction (README Path 2, deployment-guide Option A, deploy/README "Fertiges Release herunterladen") tells the operator to fetch and verify against a bare SHA256SUMS.txt. That is two names for the same artifact across the freshly-written guides — precisely the class of doc drift this PR set out to eliminate. The Test-DeploymentTemplates contract only greps for the substring SHA256SUMS, so it does not catch the divergence. Suggestion: pick one name (emitting a bare SHA256SUMS.txt also matches the majority of the docs), make all guides agree, and tighten the contract to assert the exact filename rather than the substring.

This is an automated PR-review finding and needs triage. Low-severity notes (a residual hardcoded -Version '1.0.0' default in Build-DesktopInstaller.ps1, and an untested Resolve-IsccPath.ps1) are intentionally omitted.