Update release check

bin/release-check.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Checks a published release the way a customer site sees it: no token, only public URLs.
+#
+#   bin/release-check.sh [version]    default: Plugin::VERSION
+#
+# Fails unless releases/latest is that version, ZIP and .sig are public downloads below the repository's release
+# URL (the only place GiteaUpdater accepts a package from), and the downloaded ZIP passes the signature check against
+# the key built into the plugin.
+#
+# Environment: LIT_MCP_GITEA (default https://git.loosen-it.de), only to try the script against another server.
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$root"
+
+gitea="${LIT_MCP_GITEA:-https://git.loosen-it.de}"
+repo="janniclas.loosen/WP-LIT-MCP"
+version="${1:-$(sed -n "s/.*const VERSION = '\(.*\)';/\1/p" src/Plugin.php)}"
+name="wp-lit-mcp-$version.zip"
+
+fail() { echo "ABBRUCH: $*" >&2; exit 1; }
+
+latest="$(curl -fsS "$gitea/api/v1/repos/$repo/releases/latest")" \
+    || fail "releases/latest ist ohne Anmeldung nicht abrufbar (noch kein veröffentlichtes Release? Repo nicht öffentlich?)"
+tag="$(jq -r .tag_name <<<"$latest")"
+[[ "$tag" == "v$version" ]] || fail "releases/latest liefert '$tag', erwartet v$version"
+
+asset_url() { jq -r --arg n "$1" '.assets[] | select(.name == $n) | .browser_download_url' <<<"$latest"; }
+zip_url="$(asset_url "$name")"
+sig_url="$(asset_url "$name.sig")"
+for url in "$zip_url" "$sig_url"; do
+    [[ "$url" == "$gitea/$repo/releases/download/"* ]] || fail "Asset-URL fehlt oder liegt woanders: '$url'"
+done
+
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+curl -fsSL "$zip_url" -o "$work/$name" || fail "ZIP nicht ohne Anmeldung ladbar: $zip_url"
+curl -fsSL "$sig_url" -o "$work/$name.sig" || fail "Signatur nicht ohne Anmeldung ladbar: $sig_url"
+php bin/release-sign.php verify "$work/$name" "$work/$name.sig" >/dev/null \
+    || fail "Das heruntergeladene Release besteht die Signaturprüfung nicht"
+
+echo "Release v$version in Ordnung: öffentlich ladbar, Signatur gültig"