### Added

- SHA256SUMS published alongside .deb / .rpm on tag releases.
  Enables direct consumption by Ansible's get_url checksum: and
  hand-verification via sha256sum -c. SHA-only verification is
  partial — neither the artifacts nor SHA256SUMS are signed yet;
  signing tracked separately and will land in a future release.

### Fixed

- Discovery configs no longer republish twice on initial broker
  connect. Each entity registers once per fresh-session connect,
  halving discovery traffic and journal "Registering topic" lines
  per startup.