chore(dcg): automate DCG_VERSION + checksum updates via Renovate #1067

Background

src/services/destructive-command-guard/constants.ts hardcodes DCG_VERSION and four platform-specific SHA-256 checksums in DCG_ARCHIVES. These must be kept in sync by hand whenever Destructive Command Guard releases a new version. Added in PR #1060.

Problem

Manual bumps are error-prone: a contributor could update DCG_VERSION without updating one or more checksum entries. ensureManagedBinaryInstalled verifies the archive checksum before use (see src/services/managed-binary/install.ts), so a stale or mismatched hash breaks DCG installation for the affected platform. This is the same class of issue as #481 for Semble.

Proposed solution

1. Add a helper script (scripts/update-dcg-checksums.sh) that:

   • Reads DCG_VERSION from src/services/destructive-command-guard/constants.ts
   • Downloads all four platform archives from the GitHub release (Dicklesworthstone/destructive_command_guard)
   • Computes shasum -a 256 for each
   • Patches the sha256 fields in DCG_ARCHIVES in-place

2. Wire up a Renovate custom regex manager to detect DCG_VERSION bumps:

{
  "customType": "regex",
  "description": "Update DCG binary version",
  "managerFilePatterns": ["src/services/destructive-command-guard/constants\\.ts"],
  "matchStrings": ["export const DCG_VERSION = \"(?<currentValue>[^\"]+)\""],
  "depNameTemplate": "Dicklesworthstone/destructive_command_guard",
  "datasourceTemplate": "github-releases"
}

3. Add a postUpgradeTasks entry to run scripts/update-dcg-checksums.sh after each version bump so checksums are recomputed and committed atomically with the version change.

References

• PR [Improve] Harden DCG binary installation #1060 (initial DCG binary service)
• Issue chore(semble): automate SEMBLE_VERSION + SEMBLE_SHA256 updates via Renovate #481 (same automation for Semble — implement both together if convenient, since they'll likely share most of the script/config shape)
• src/services/destructive-command-guard/constants.ts — DCG_VERSION and DCG_ARCHIVES
• Existing Renovate config in renovate.json