[puritysb]

Deliver the already merged photo-upload path hardening (#740) as npm 2.1.1. Shared, hooks, bridge and setup advance together; daemon and portable fixture versions are mirrored. Root VERSION and all other delivery channels remain unchanged. The owner authorized npm-only publication and resolving the CI outage.

GitHub release download URLs returned persistent HTTP 504, connection timeouts/resets and intermittent API 502. CI now resolves exact official release asset identities and verifies full size and SHA-256 before extraction. Java CodeQL uses the same 2.27.4 bundle; Gradle's version comes from the committed wrapper and retains a checksum. Rust OSV Scanner retains its independent pinned checksum. Only the disposable ESP32 inventory job enables Python transport fallback. API retries are bounded to three attempts and refresh stale redirects. Authentication/TLS failures, unexpected identities, missing unreviewed hashes, corrupt and partial transfers fail closed. Credentials remain confined to non-redirecting API requests; allow-listed GitHub storage receives no credential. Storage 404 responses obtain a fresh link for the same verified asset.

Two pre-digest ROM archives are explicitly pinned by asset ID, size and reviewed SHA-256. The zip's thirteen ELF payloads match the existing installation; its inspected tools.json supplies the upstream tar checksum. These changes neither change npm package bytes nor bypass any scan.

Validation:

• Clean candidate e01bfd6 passed full recorded verification: 27 automatic gates, 5 explicit host/channel skips; 7,622 passing Vitest tests, native builds and 12 clean npm package checks with a 60-second soak. Receipt committed.
• Installed ABI, photo-path boundary and Swift-only / CLI-only / coexistence acceptance passed against public Mac Store 2.1.0 / 10301; Swift automatically recovered port 9120 and downstream connections in 177.2 seconds. Manual Node mode restored; private screenshots remain local.
• All 1,564 npm files at the CI-only update matched the installed candidate byte for byte.
• Latest transport fix: 15 offline security/transport regressions, actionlint, verify:quick (7,622 Vitest passes) and verify:changed passed. Real complete API transfers validated CodeQL, Gradle, OSV and ESP32 archives; injected first-attempt API 502 recovered on the second real transfer. A fresh isolated ips35 dependency inventory completed successfully. Fresh hosted Rust audit passed and Java CodeQL reached source compilation after successful downloads; the full inventory and remaining latest hosted checks are being observed.

After latest required CI passes, merge normally and tag only npm-v2.1.1. Monitor npm Release and read back all four exact versions/latest tags, setup README and GitHub release. Record measured delivery in README, RELEASING and security docs. No tag/upload has been attempted; registry latest remains 2.1.0.