Add stable manifest URL for NinjaOne deployments

docs/ocsentinel-deployment.md

@@ -36,7 +36,7 @@ Initial install/update:
 
 ```powershell
 & "C:\Program Files\OCSentinel\scripts\update-ocsentinel.ps1" `
-  -ManifestUrl "https://gitea.officecom.cloud/officecom/oc-sentinel/releases/download/v1.2.3/version.json" `
+  -ManifestUrl "https://gitea.officecom.cloud/officecom/oc-sentinel/raw/main/release/stable/version.json" `
   -Force
 ```
 
@@ -44,7 +44,7 @@ Routine update:
 
 ```powershell
 & "C:\Program Files\OCSentinel\scripts\update-ocsentinel.ps1" `
-  -ManifestUrl "https://gitea.officecom.cloud/officecom/oc-sentinel/releases/download/v1.2.3/version.json"
+  -ManifestUrl "https://gitea.officecom.cloud/officecom/oc-sentinel/raw/main/release/stable/version.json"
 ```
 
 Runtime:
@@ -72,7 +72,9 @@ As of July 16, 2026, the first manual release is already published:
 
 - tag: `v1.2.3`
 - release URL: `https://gitea.officecom.cloud/officecom/oc-sentinel/releases/tag/v1.2.3`
-- manifest URL: `https://gitea.officecom.cloud/officecom/oc-sentinel/releases/download/v1.2.3/version.json`
+- stable manifest URL: `https://gitea.officecom.cloud/officecom/oc-sentinel/raw/main/release/stable/version.json`
+
+The manifest is intentionally version-independent for NinjaOne. Only the JSON content changes per release; the NinjaOne task URL stays the same.
 
 This means NinjaOne rollout can start immediately without waiting for a Gitea runner.
 
@@ -83,3 +85,4 @@ When a Gitea runner is added later, the usual next step is:
 1. connect to the runner host through SSH or RDP, depending on the server type
 2. install and register the Gitea runner
 3. let `.gitea/workflows/client-build.yml` publish future release artifacts automatically
+4. update `release/stable/version.json` automatically as part of the release flow