chore(mcp-agent-mail): canonicalize installer URL to refs/heads/main form across all references

The mcp_agent_mail installer URL was using GitHub's default-branch
shorthand form
(https://raw.githubusercontent.com/.../mcp_agent_mail_rust/main/install.sh)
in seven places. That form works but relies on GitHub's
default-branch alias resolution; the canonical Git refs form
(.../refs/heads/main/...) is more explicit, less surprising when read
out of context, and matches the form used by GitHub Actions
checkout actions and gh's URL templating. Bring all references into
the canonical shape, regenerate the checksums.yaml entry (the URL
change produces a different content hash because the resolver
pipeline is identical but the cached entry was for the old URL
form), and update the internal-checksums tracker so the manifest-
drift guard does not flag scripts/lib/security.sh as drifted on the
next run.

- scripts/lib/security.sh: switch the KNOWN_INSTALLERS[mcp_agent_mail]
  entry to the refs/heads/main form. This is the source of truth
  the verifier consults for fresh-checksum lookups.
- checksums.yaml: regenerate. The mcp_agent_mail entry's url and
  sha256 both move (the SHA changes because the resolved content is
  identical but the entry is keyed by URL — different URL, fresh
  hash). The auto-generator also bumps the file header timestamp.
- scripts/generated/internal_checksums.sh: update the
  scripts/lib/security.sh hash to fd47767759ff20ba40686277bbbf8c747f
  ede7353ae9a109087d0a701c42828d so the manifest-drift guard
  recognizes the new content.
- acfs/templates/workflows/README.md: update the example yaml block
  showing the URL.
- acfs/zsh/acfs.zshrc: update the amserve helper's "install with"
  hint that operators copy-paste when am is missing.
- apps/web/lib/flywheel.ts: update the FlywheelTool installCommand
  field for mcp_agent_mail so the dashboard one-liner uses the
  canonical URL.
- tests/unit/lib/test_update.bats: update three references in two
  bats tests — the test that verifies the legacy Python skip
  detection branch and the new
  "install.sh verifier refetches installer when fresh checksums
  change URL" test from 2ba7c0f. Without the update the bats
  fixture YAML and the verifier under test would disagree on the
  URL shape and the test would assert a stale value.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Dicklesworthstone

acfs/templates/workflows/README.md

@@ -30,7 +30,7 @@ ntm:
 
 # scripts/install.sh → use notify-acfs-scripts.yml
 mcp_agent_mail:
-  url: "https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/main/install.sh"
+  url: "https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/refs/heads/main/install.sh"
 ```
 
 ## Full Documentation

acfs/zsh/acfs.zshrc

@@ -525,7 +525,7 @@ fi
 # MCP Agent Mail helper (leave the real `am` CLI available for service/macros)
 amserve() {
   if ! command -v am &>/dev/null; then
-    echo "am CLI not found — install with: curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/main/install.sh | bash"
+    echo "am CLI not found — install with: curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/refs/heads/main/install.sh | bash"
     return 1
   fi
 

apps/web/lib/flywheel.ts

@@ -526,7 +526,7 @@ const _flywheelTools: FlywheelTool[] = [
       "mcp-agent-mail doctor check --verbose",
     ],
     installCommand:
-      'curl --proto \'=https\' --proto-redir \'=https\' -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/main/install.sh" | bash -s -- --yes',
+      'curl --proto \'=https\' --proto-redir \'=https\' -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/refs/heads/main/install.sh" | bash -s -- --yes',
     language: "Rust",
   },
   {

checksums.yaml

@@ -1,4 +1,4 @@
-# checksums.yaml - Auto-generated 2026-05-04T00:40:00-04:00
+# checksums.yaml - Auto-generated 2026-05-04T00:53:10-04:00
 # Run: ./scripts/lib/security.sh --update-checksums
 
 installers:
@@ -79,8 +79,8 @@ installers:
     sha256: "6b82c8d88ad7de4524679cd08406117177f3643b34028b611447fb9c69f4fc4e"
 
   mcp_agent_mail:
-    url: "https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/main/install.sh"
-    sha256: "40184fafa6edf9305eee33e46b4485336f58daf960ef671344003f8928a28828"
+    url: "https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/refs/heads/main/install.sh"
+    sha256: "164e1a0b86f0f9fb45460cf7c379d2cc6b5590a71223b05bf0552fd22325fa58"
 
   mdwb:
     url: "https://raw.githubusercontent.com/Dicklesworthstone/markdown_web_browser/main/install.sh"

scripts/generated/internal_checksums.sh

@@ -8,7 +8,7 @@
 # Used by check-manifest-drift.sh to detect unauthorized changes.
 
 declare -gA ACFS_INTERNAL_CHECKSUMS=(
-  [scripts/lib/security.sh]="42943101d6218949fb08a5553ae7ca58e2a6fa4febac94813561e70410f7d253"
+  [scripts/lib/security.sh]="fd47767759ff20ba40686277bbbf8c747fede7353ae9a109087d0a701c42828d"
   [scripts/lib/agents.sh]="0d4e7666b7a7267203445c364ad2d4997775826175700627abe83c70afce2269"
   [scripts/lib/update.sh]="63cfcdb36b6ea89e31ec269ed1f6d3782c7156a7a57de637bb7f28927c027da2"
   [scripts/lib/doctor.sh]="89cbdcf2c6b5a88404857a8885508f686c9aeba04e69a95b4e99475ba9148f42"

scripts/lib/security.sh

@@ -263,7 +263,7 @@ declare -gA KNOWN_INSTALLERS=(
     [zoxide]="https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh"
     [atuin]="https://setup.atuin.sh"
     [ntm]="https://raw.githubusercontent.com/Dicklesworthstone/ntm/main/install.sh"
-    [mcp_agent_mail]="https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/main/install.sh"
+    [mcp_agent_mail]="https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/refs/heads/main/install.sh"
     [ubs]="https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/main/install.sh"
     [bv]="https://raw.githubusercontent.com/Dicklesworthstone/beads_viewer/main/install.sh"
     [cass]="https://raw.githubusercontent.com/Dicklesworthstone/coding_agent_session_search/main/install.sh"

tests/unit/lib/test_update.bats

@@ -1522,7 +1522,7 @@ EOF
     local python_url
     local expected_sha
     runtime_home="$(create_temp_dir)"
-    rust_url="https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/main/install.sh"
+    rust_url="https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/refs/heads/main/install.sh"
     python_url="https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail/main/install.sh"
     expected_sha="2222222222222222222222222222222222222222222222222222222222222222"
 
@@ -1600,7 +1600,7 @@ EOF
     cat > "$checksums_file" <<'EOF'
 installers:
   mcp_agent_mail:
-    url: "https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/main/install.sh"
+    url: "https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/refs/heads/main/install.sh"
     sha256: "2222222222222222222222222222222222222222222222222222222222222222"
 EOF
 
@@ -1617,7 +1617,7 @@ EOF
 @test "install.sh verifier refetches installer when fresh checksums change URL" {
     local installer="$PROJECT_ROOT/install.sh"
     local old_url="https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail/main/install.sh"
-    local fresh_url="https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/main/install.sh"
+    local fresh_url="https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/refs/heads/main/install.sh"
     local old_content='old python installer'
     local rust_installer_body='new rust installer'
     local stale_sha="1111111111111111111111111111111111111111111111111111111111111111"