v1.4.5: signed releases + stability hardening — release manifest (CHECKSUMS + CHECKSUMS.sig) signed by an offline key, verified by update.sh against the pinned pubkey before any file is replaced (scripts/verify.sh audits installs anytime); rebuild_daily_stats is now an ordered ledger replay (re-baseline re-seeds total_active, crash-duplicated rows count once); oversized OSM tag values can no longer wedge alert delivery (clip + chunk hard cap); config errors and unknown CLI args exit 2; installer's non-git refresh replaces wholesale; +13 tests incl. new tests/test_install.sh