Project Genesis - how to push a new update

The whole thing is now ONE command. It builds, signs, uploads to the live
site, and verifies the result. See UPDATES.md for the full explanation.

============================================================
One-time setup in this terminal
============================================================

Point the tools at your keys (these never go in a file or in git):

    set GENESIS_SIGNING_KEY=E:\New folder\genesis-signing-key.pem
    set GENESIS_UPLOAD_KEY=your-upload-key-here

- GENESIS_SIGNING_KEY  : your private signing key. Back it up offline.
- GENESIS_UPLOAD_KEY   : the site's upload key. This is a server write
                         credential - never put it in a file, never commit it,
                         never paste it anywhere it will be saved.

============================================================
Push a new version
============================================================

1. Edit CHANGELOG.md - add a new "### Phase NN: ..." section at the bottom
   describing what changed. That text becomes the release notes.

2. Run (change the version number):

       python tools/release.py push --version 1.0.2 --notes-file CHANGELOG.md --notes-latest

   That bumps the version in the app, packages and signs it, uploads the
   manifest and the new zip, and then verifies the live site serves exactly
   what was signed. If anything is wrong it stops and tells you.

   Add --pages if you changed the download page (tools/site_template.html) and
   want index.html/icon.png re-uploaded too.

That is it. Every copy of Genesis already installed picks up the new version on
its own - it checks on startup, downloads in the background, and installs
itself.

============================================================
Check it worked
============================================================

    python tools/release.py check

Asks the live site the same question a customer's copy would ask.

------------------------------------------------------------
NOTE: an older version of this file had the upload key written into it in
plain text. That key must be treated as exposed and rotated. The key now lives
only in the GENESIS_UPLOAD_KEY environment variable, never in a file.
