Finalize release downloads, installation prompt and verified handoff

docs/ROADMAP.md

@@ -64,8 +64,9 @@ open and deferred; do not continue expanding them without a renewed request.
     public speech archive delivery remain open.
   - [x] Genuine packaged Linux Google/speech retrieval and public headless archive
     delivery; full-byte public download verified. See [evidence](LINUX-SPEECH-0.1.6.md).
-  - [ ] Rotate the origin protection value exposed during upload-limit diagnostics;
-    keep values out of Git and coordinate its Cloudflare/Infisical configuration.
+  - [x] Rotate the exposed origin protection value using protected Infisical
+    storage and coordinated Cloudflare/NPM updates; old value rejected on all
+    three affected services, public access verified, no values committed.
   - [x] Genuine shared-service ASR/Google lifecycle passed: verified speech
     excerpts, zero raw reencodes through policy failure/retry, and retained
     query reader; [proof](SPEECH-INTEGRATION.md).