fix(nibe_local): version the DER correction so the channel can publish it

[HuggeK]

The driver release failed on main with

error: nibe_local: changed artifact needs a higher version than 1.1.0

Nothing shipped, which is the correct outcome.

#53 corrected nibe_local's manifest from ders: [meter] to ders: [heatpump] and read that as catalog-only metadata, so it left the version at 1.1.0. It is not catalog-only. _load_channel copies ders into the artifact's capabilities, and the channel signs source and metadata as one file — so the correction moved the published bytes under a version that has already shipped. The channel refused, and it was right to: that immutability is what lets an operator name the bytes a site is running.

So nibe_local takes a patch, 1.1.0 → 1.1.1.

Why a patch and not a minor

No register, field or emitted metric changed — only the DER the catalog states. This follows the precedent in #32, where drivers that gained a control path took a minor because a host could now do something new, and the rest took a patch for a bytes-only move.

The Lua source is untouched and its sha256 with it, and bump_driver leaves the DRIVER table alone because the file is byte-identical to its FTW baseline — so the provenance guarantee #29 established is not spent on this.

Verified

Built the channel entries locally against the currently published beta manifest and compared every artifact digest:

total drivers in tree: 80  published: 80
changed bytes vs published (1):   ('nibe_local', '1.1.0', '1.1.1')
BLOCKED - needs higher version (0):

Before the bump that same check reported nibe_local blocked, reproducing the release failure exactly. nibe_local is the only driver that differs from what is published — the release stops at the first offender, so this confirms there is no second one waiting behind it.

Other checks run

• validate_manifest.py — 80 manifests, 0 errors
• generate_index.py, generate_devices.py, generate_support_status.py — regenerated and idempotent; sync_manifests.py --id nibe_local reports the manifest matches its source
• generate_history.py --check — driver history intact
• host_api_check.py --check, check_public_boundary.py — pass
• pytest drivers/tests tests — 2947 passed. Four modules needing the package extra (cryptography) were skipped, and 10 tests fail identically on the unmodified base commit: they need the lua55 interpreter the Makefile builds, plus one Windows path-handling issue in test_blueprint.py. Nothing here is affected by this change; CI runs all of them.

The trap that caused it

CONTRIBUTING.md said to raise the version whenever the Lua source changes, which is exactly what #53 followed. It now also names the manifest fields that reach the signed artifact — ders, protocol, and a tested_devices manufacturer and model_family — and warns that this check runs on main after the merge rather than in the pull request, because only the release job can read the channel.

Possible follow-up, deliberately not in this PR

The gap is structural: a PR that edits one of those manifest fields merges green and breaks the release afterwards. A pre-merge job could download the published manifest.json and run the same comparison — it needs only the public key, which is already in the workflow env and not a secret. That is a new check rather than a fix to this failure, so it is left out here.

The CHANGELOG.md entry from #53 is amended in the same commit: it claimed the version and the published bytes were untouched, and half of that is no longer true.