chore: refresh release checksum provenance

Refresh checksums.yaml with the canonical security updater after the release doctor reported the upstream ohmyzsh installer hash had changed. The reviewed diff is limited to the generated timestamp and the ohmyzsh sha256 entry.

Regenerate the web manifest provenance so the embedded checksumsYamlSha256 matches the refreshed checksum file and scripts/check-manifest-drift.sh reports a clean generated surface.

Verified with ./scripts/lib/security.sh --verify and /dp/automated_flywheel_setup_checker validate/list/check, including URL and hash validation for all 42 installer entries.

Author: Dicklesworthstone

apps/web/lib/generated/manifest-modules.ts

@@ -33,7 +33,7 @@ export interface ManifestProvenanceMetadata {
 export const manifestProvenance = {
   acfsVersion: "0.7.0",
   manifestSha256: "1dc8d9788bf9ebe34e1bc3b9029efc8cf0a88ded099e8255416f844cc9b5300f",
-  checksumsYamlSha256: "e4b9e85a9c8b3e6865062c126079da8460ec8892c6cb73bc17bb9bb72911927b",
+  checksumsYamlSha256: "d6fb615716c96899769c12a04e64d0a5a4fa91797d6876994f84db2f1e0460a6",
 } as const satisfies ManifestProvenanceMetadata;
 
 export const manifestModules: ManifestModuleMetadata[] = [

checksums.yaml

@@ -1,4 +1,4 @@
-# checksums.yaml - Auto-generated 2026-06-24T15:04:51+00:00
+# checksums.yaml - Auto-generated 2026-06-26T18:39:50-04:00
 # Run: ./scripts/lib/security.sh --update-checksums
 
 installers:
@@ -104,7 +104,7 @@ installers:
 
   ohmyzsh:
     url: "https://install.ohmyz.sh/"
-    sha256: "4534045f4d983abd9716cd2f515bbe3c2b31ba5b8fd1fef147838778427477bb"
+    sha256: "95118b50d062198597e2b73d3a57b609fd95ca68cdc86faf4460d955f0172b61"
 
   opencode:
     url: "https://opencode.ai/install"