chore(semble): automate SEMBLE_VERSION + SEMBLE_SHA256 updates via Renovate #481

Background

semble-downloader.ts hardcodes SEMBLE_VERSION and four platform-specific SHA-256 checksums in SEMBLE_SHA256. These must be kept in sync manually whenever Semble releases a new version. Raised in PR #399.

Problem

Manual bumps are error-prone: a contributor could update SEMBLE_VERSION without updating one or more checksum entries. The downloader now hard-errors on a missing checksum (by design), so this would break Semble for the affected platform.

Proposed solution

1. Add a helper script (scripts/update-semble-checksums.sh) that:

   • Reads SEMBLE_VERSION from semble-downloader.ts
   • Downloads all four platform archives from the GitHub release
   • Computes shasum -a 256 for each
   • Patches SEMBLE_SHA256 in-place

2. Wire up a Renovate custom regex manager to detect SEMBLE_VERSION bumps:

{
  "customType": "regex",
  "description": "Update semble binary version",
  "managerFilePatterns": ["src/services/code-index/semble/semble-downloader\\.ts"],
  "matchStrings": ["const SEMBLE_VERSION = \"(?<currentValue>[^\"]+)\""],
  "depNameTemplate": "Zoo-Code-Org/sembleexec",
  "datasourceTemplate": "github-releases"
}

3. Add a postUpgradeTasks entry to run scripts/update-semble-checksums.sh after each version bump so checksums are recomputed and committed atomically with the version change.

References

• PR feat(code-index): add Semble as a local on-the-fly embedding provider #399 (initial Semble integration)
• src/services/code-index/semble/semble-downloader.ts — SEMBLE_VERSION and SEMBLE_SHA256
• Existing Renovate config in renovate.json