L4 0.1.0-alpha.5

The installer release picker remains available when GitHub's shared unauthenticated REST quota returns 403 or 429. It falls back to the public repository release feed, so public release discovery does not require adding a GitHub credential to the site.

Feed discovery is bounded and accepts supported versions only when published checksums name the deployment artifact and manifest. The manifest must match the version and declare standalone Server support. Incomplete or incompatible releases remain excluded; installation still verifies full artifact checksums.

This is a follow-up to the autonomous Server + Shell release alpha.4. It changes no Server schema, local accounts, membership, files or realtime behavior. Customer Servers remain pinned and update only when their operator selects a release. Public installer Cloudflare OAuth rights/consent and optional provider/native acceptance remain separately documented.

Validation includes 517 tests, types/lint/builds, independent Server integration and Compose checks, a real public-feed fallback with REST forced to 403, and the deployed site Preview release endpoint.