carlos / platform Public

Fixes #269. Staging read the whole release build into memory, so a ~99 MB build ran the root stage pass (MemoryMax=256M) out of memory and the deploy waited for the hourly adopt pass. Staging now streams the artifact into a temp file of its own beside the destination, hashing as it goes, and renames only bytes that match the manifest's sha256. A mismatch or failed read leaves the staged copy alone, as before.

Status: Astra round 1 REJECT (one P1: a shared temp name let a concurrent writer's partial bytes be published under a passing hash; fixed in 207517f4 with a deterministic overlap test), round 2 ACCEPT. Waiting on CI, then Paul's merge call. Deployments with a 512 MB MemoryMax drop-in on carlos-stage.service or carlos-adopt.service can remove it once boxes run a release with this.