release: publish toolbox aggregate 0.3.1

README.md

@@ -66,7 +66,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported
 ## Production deployment behind Traefik
 
 The committed `compose.yaml` is the shortest production path. Its release
-container downloads the immutable Toolbox 0.3.0 ZIP during the image build,
+container downloads the immutable Toolbox 0.3.1 ZIP during the image build,
 verifies SHA-256 before extracting it, and then copies only the verified static
 files into the pinned unprivileged nginx image. Node.js and a local portal
 assembly are not required on the deployment host.
@@ -117,8 +117,8 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
 must declare the pinned reverse-DNS id and version. Application and portal
 versions are independent.
 
-`release/toolbox.lock.json` is the reviewed v0.3.0 lock. Its URLs and checksums
-pin the published PDF Tools 0.3.4, XSLT Tools 0.3.2, and OneNote Tools 0.2.0
+`release/toolbox.lock.json` is the reviewed v0.3.1 lock. Its URLs and checksums
+pin the published PDF Tools 0.3.4, XSLT Tools 0.3.2, and OneNote Tools 0.2.1
 release bytes. Use
 `release/toolbox.lock.example.json` as the template for a future release and
 verify every downloaded asset before committing updated values. Artifacts may be:
@@ -140,7 +140,7 @@ npm run assemble -- \
   --lock release/toolbox.lock.json \
   --portal-dist dist \
   --output build/toolbox \
-  --archive build/add-ideas-toolbox-0.3.0.zip
+  --archive build/add-ideas-toolbox-0.3.1.zip
 ```
 
 Existing output is refused. Pass `--force` only when replacing those exact
@@ -160,8 +160,8 @@ build/toolbox/
     ├── xslt/
     └── onenote/
 
-build/add-ideas-toolbox-0.3.0.zip
-build/add-ideas-toolbox-0.3.0.zip.sha256
+build/add-ideas-toolbox-0.3.1.zip
+build/add-ideas-toolbox-0.3.1.zip.sha256
 ```
 
 The assembler verifies SHA-256 before opening an artifact, validates every app
@@ -182,7 +182,7 @@ directory separately:
 ```sh
 npm run package:static -- \
   --input build/toolbox \
-  --output artifacts/add-ideas-toolbox-0.3.0.zip
+  --output artifacts/add-ideas-toolbox-0.3.1.zip
 ```
 
 This also emits a `.sha256` sidecar.
@@ -199,9 +199,9 @@ normal local XML/XSLT transformations do not require that permission.
 
 ```sh
 podman build -f Containerfile \
-  -t git.add-ideas.de/zemion/toolbox:0.3.0 .
+  -t git.add-ideas.de/zemion/toolbox:0.3.1 .
 podman run --rm -p 8080:8080 \
-  git.add-ideas.de/zemion/toolbox:0.3.0
+  git.add-ideas.de/zemion/toolbox:0.3.1
 ```
 
 For a direct-port local deployment after assembly, use the separate example:
@@ -218,7 +218,7 @@ docker login git.add-ideas.de
 docker buildx build \
   --platform linux/amd64,linux/arm64 \
   --file Containerfile.release \
-  --tag git.add-ideas.de/zemion/toolbox:0.3.0 \
+  --tag git.add-ideas.de/zemion/toolbox:0.3.1 \
   --tag git.add-ideas.de/zemion/toolbox:0.3 \
   --push .
 ```
@@ -244,8 +244,8 @@ permission to push code, releases, and container packages.
    all three apps, switch between them, and confirm the encoded `toolbox`
    context.
 5. Verify the distribution with
-   `(cd build && sha256sum -c add-ideas-toolbox-0.3.0.zip.sha256)`.
-6. Commit the reviewed lock, tag the toolbox release (for example `v0.3.0`), and
+   `(cd build && sha256sum -c add-ideas-toolbox-0.3.1.zip.sha256)`.
+6. Commit the reviewed lock, tag the toolbox release (for example `v0.3.1`), and
    push the branch and tag to Gitea.
 7. In Gitea, open **Releases → New release**, select the tag, and upload the
    static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a