Automate verified official engine updates

[jevgeni17]

Goal

Provide a reproducible procedure for updating the pinned official Ace Stream engine and its build inputs without silently trusting a mutable download.

Procedure

• Keep version, official HTTPS URL, archive SHA-256, architecture, base-image digest, image revision, and Python dependency lock in one reviewed release manifest.
• Add a maintainer script that downloads only from the approved official host, verifies the expected checksum, builds the local image, queries the engine API version, and runs a smoke test.
• Hash-lock Python packages where technically compatible; record any Ubuntu packages that cannot be fully pinned and why.
• Require an explicit source change and review for every engine update. Never auto-update the closed-source engine at runtime.
• Document rollback to the preceding verified manifest and image revision.

Acceptance criteria

• A checksum mismatch, unexpected redirect/host, wrong architecture, or reported-version mismatch fails the update.
• The release image builds from a clean Docker cache and passes EngineKit tests.
• The procedure records source URLs, licenses/terms reviewed, checksums, test date, and supported Mac architectures.
• Updating the manifest causes EngineKit to replace only its own labelled stale container while preserving named state/cache volumes.
• The preceding verified version remains documented as the rollback target.