fix(anime): pin linux-x64 bridge checksum and fetch release by tag

- Add PINNED_BUNDLE_SHA256 entry for linux-x64-bundle.zip so Linux no longer refuses to start with "No pinned checksum"
- Fetch the bridge release by its pinned tag (releases/tags/<tag>) instead of listing newest releases, so an upstream publish can't swap in an unverified asset
- Update docs and changelog to describe the pin/tag behavior

src/main/runtime/anime-bridge-installer.ts

@@ -2,8 +2,9 @@ import { spawn } from 'node:child_process';
 import { chmod, mkdir, rm, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import {
-  BUNDLE_RELEASES_URL,
+  bundleReleaseUrl,
   findBundleBinaries,
+  PINNED_BUNDLE_TAG,
   resolveBundleAssetName,
   selectBundleAsset,
   verifyPinnedBundle,
@@ -121,16 +122,18 @@ export async function ensureBridgeBinaries(options: EnsureBridgeOptions): Promis
   }
 
   options.onProgress?.({ stage: 'locating', progress: null });
-  const releasesResponse = await fetchImpl(BUNDLE_RELEASES_URL, {
+  const releasesResponse = await fetchImpl(bundleReleaseUrl(), {
     headers: { Accept: 'application/vnd.github+json' },
     signal: AbortSignal.timeout(RELEASES_TIMEOUT_MS),
   });
   if (!releasesResponse.ok) {
-    throw new Error(`Could not list anime bridge releases (${releasesResponse.status}).`);
+    throw new Error(
+      `Could not read anime bridge release ${PINNED_BUNDLE_TAG} (${releasesResponse.status}).`,
+    );
   }
   const asset = selectBundleAsset(await releasesResponse.json(), assetName);
   if (asset === null) {
-    throw new Error(`No published anime bridge release contains ${assetName}.`);
+    throw new Error(`Anime bridge release ${PINNED_BUNDLE_TAG} has no ${assetName}.`);
   }
 
   options.onProgress?.({ stage: 'downloading', progress: 0 });