SendToKobo local first-install program candidate (not a release)

This computer-only candidate combines the separately pinned 19-file receiver
update candidate with reviewed historical dependency and source materials.
It is not a signed production release, an installation authorization, or proof
that FBInk/NickelMenu/the receiver runs on a connected device.

Receiver core: local web-update-candidate-c054514e28f84480a1ee03186edcdd0a,
manifest SHA256 f096c36d84c6c38fbd14b0e071e949b35cc462d924ef7013e39d2f488a7ffc0d.
Support baseline: windows-installer-0.4.17 / 20260923T185902978Z,
SHA256SUMS.txt pin d1a837c486c5251375e05a615bd12cee2ee38f923336247e6a995b89bec12dc6.
The historical user README, pairing instructions, whole-bundle checksum list
and v1.25 binary-origin note are deliberately not copied as current instructions.

The shipped FBInk executable is the reviewed 886f25f upstream CI binary, not
the old v1.25 dynamically linked executable. FBINK_UNIVERSAL_ORIGIN.txt and
fbink-universal.json identify its binary, main source and four submodule
archives. No old libfbink.so is included. Upstream CI's then-current toolchain
is not pinned here; byte-identical FBInk reproduction is not claimed.

FBInk-v1.25.0-source.tar.xz and FINISH_ACKNOWLEDGEMENT_SOURCE.mjs are retained
for the unchanged Unifont-derived acknowledgement PNGs, not as the source of
the 886f25f executable. GPLv3+ license and credits including Unifont attribution
are retained. Go, go-qrcode and NickelMenu license notices are also retained.
The complete receiver source/toolchain distribution and a complete formal
release compliance review are not bundled or concluded by this candidate.
completeReleasePackage=false; releaseReady=false.

The endpoint is the fixed default https://pd.sendtokobo.top, for a separately
authorized first-install planner to create only when absent; existing endpoint
settings must be preserved. No network request is made by package validation.
NickelMenu KoboRoot.tgz, Kobo settings, NickelMenu provenance, device identity,
session state and receiver ownership receipt are excluded from package paths.
Those require independently derived plans, conflict checks and authorization.
NickelMenu archive publication, when applicable, must remain the last step.
