### Added - SHA256SUMS published alongside .deb / .rpm on tag releases. Enables direct consumption by Ansible's get_url checksum: and hand-verification via sha256sum -c. SHA-only verification is partial — neither the artifacts nor SHA256SUMS are signed yet; signing tracked separately and will land in a future release. ### Fixed - Discovery configs no longer republish twice on initial broker connect. Each entity registers once per fresh-session connect, halving discovery traffic and journal "Registering topic" lines per startup.