fix(updates): allow notify endpoint past CSRF + portable JSON parse in release.sh

- csrf-protection: skip CSRF validation on /api/system/update-notify. The
  endpoint has its own X-DashCaddy-Notify-Secret auth and is only ever called
  machine-to-machine; browsers never reach it. Without this, the CSRF cookie
  check rejects the notify POST before the secret comparison runs.
- release.sh: the verify step piped curl into `node -p ".../dev/stdin"` which
  works on Linux but blows up on Windows/git-bash. Replaced with portable
  grep+sed extraction so the same script works on both publisher OSes.

scripts/release.sh

@@ -173,7 +173,7 @@ fi
 # ── Verify ───────────────────────────────────────────────────────────────
 echo
 echo "─── Verifying live ───"
-SERVED_VER="$(curl -fsSL --max-time 5 https://get.dashcaddy.net/release/version.json | node -p "JSON.parse(require('fs').readFileSync('/dev/stdin')).version")"
+SERVED_VER="$(curl -fsSL --max-time 5 https://get.dashcaddy.net/release/version.json | grep -oE '"version"[[:space:]]*:[[:space:]]*"[^"]+"' | head -1 | sed -E 's/.*"([^"]+)"$/\1/')"
 [[ "$SERVED_VER" == "$VERSION" ]] || { echo "MISMATCH: get.dashcaddy.net serves $SERVED_VER, expected $VERSION" >&2; exit 1; }
 echo "  get.dashcaddy.net  → $SERVED_VER ✓"
 
@@ -183,7 +183,8 @@ SHA_HTTP="$(curl -fsSL --max-time 30 "https://get.dashcaddy.net/release/dashcadd
 echo "  tarball sha256     → $SHA_HTTP ✓"
 
 if [[ "$MIRROR_OK" == "true" ]]; then
-  GET2_VER="$(curl -fsSL --max-time 5 https://get2.dashcaddy.net/release/version.json 2>/dev/null | node -p "try{JSON.parse(require('fs').readFileSync('/dev/stdin')).version}catch{'unreachable'}" 2>/dev/null || echo unreachable)"
+  GET2_VER="$(curl -fsSL --max-time 5 https://get2.dashcaddy.net/release/version.json 2>/dev/null | grep -oE '"version"[[:space:]]*:[[:space:]]*"[^"]+"' | head -1 | sed -E 's/.*"([^"]+)"$/\1/')"
+  [[ -z "$GET2_VER" ]] && GET2_VER=unreachable
   if [[ "$GET2_VER" == "$VERSION" ]]; then
     echo "  get2.dashcaddy.net → $GET2_VER ✓"
   else