Setu 0.1.5: followed manifest URLs and setu upgrade - #21

Spec: docs/specs/2026-10-21-setu-0.1.5-design.md.

Apps follow their manifest URL

• Publishing from a URL stores it (app_sources, migration 0004).
• Every 6 hours (first round 1 min after start), and on Check now, Setu fetches it with the publish guards and publishes a version not yet published. It never replaces a published one, and it refuses a manifest for another app id. Each check records checked_at and last_error.
• API: AppOut.source, POST /api/v1/apps/{id}/check and DELETE /api/v1/apps/{id}/source (operator and above).
• UI: the Apps card shows the URL and the last check, with Check now and Stop following.

setu upgrade [--version X] [--allow-downgrade]

• Root only. It resolves the latest release via the GitHub API, downloads the archive and SHA256SUMS, verifies the checksum, extracts the binary and checks it reports the version asked for.
• On a control plane it takes a self-backup first and aborts if that fails. Then it installs /opt/setu/setu, restarts setu and setu-agent, and waits up to 90 s for /healthz.
• Tried in a Debian 13 container against the real v0.1.4 release (download, verify, install); 404s and downgrades are refused.

Also

• setu reads /etc/setu/setu.toml when the current directory has none.
• Docs (OPERATIONS and INSTALL upgrading sections), CHANGELOG, version 0.1.5.

Gate

fmt and clippy are clean; scripts/test.sh 393 passed, 0 failed; UI lint, typecheck and 58 tests pass; links OK.