fix: align deb/site to HelperVersion 0.3.6 (version audit)

todo-list-3 version-audit: fix stale 0.3.4 defaults in build-deb.sh and
printit index deb blurb; document audit in PACKAGING; smoke asserts deb
fallback. CDN last-published 0.3.2/0.1.2 checksums left intentional.

docs/PACKAGING.md

@@ -25,12 +25,28 @@ same string when `job.go` is not on disk):
   `packaging-metadata.txt`.
 - Binary build: `scripts/build-win-linux.sh` greps `HelperVersion` from
   `job.go`.
-- Smoke: `platform/smoke-packaging-metadata.sh` fails if tray/menubar scripts
-  drift from `HelperVersion`.
+- Linux deb: `platform/linux/deb/build-deb.sh` greps `HelperVersion` (fallback
+  `"0.3.6"`).
+- Smoke: `platform/smoke-packaging-metadata.sh` fails if tray/menubar/deb
+  scripts drift from `HelperVersion`.
 
 Override for a one-off stamp: `VERSION=x.y.z` (env) on the build/install
 scripts. Do not invent a second version constant.
 
+### HelperVersion 0.3.6 audit (todo-list-3)
+
+Scan date: 2026-10-14. Source of truth: `internal/job.HelperVersion` = **0.3.6**.
+
+| Area | Status |
+|------|--------|
+| `job.go` / sidecar / certificate.html / site product string | **0.3.6** |
+| NSIS / WiX / common.ps1 / menubar / build-pkg / build-installer fallbacks | **0.3.6** |
+| `platform/linux/deb/build-deb.sh` fallback was **0.3.4** | **Fixed** → grep `HelperVersion` + fallback **0.3.6** |
+| Site deb blurb was **0.3.4** | **Fixed** → **0.3.6** + lag note |
+| CDN `DOWNLOADS-MANIFEST` checksums | Intentionally last-published **0.3.2** / **0.1.2**; 0.3.6 Windows rows remain **TBD** until upload |
+
+Re-run: `./platform/smoke-packaging-metadata.sh`
+
 ## Windows tray (no elevated MSI)
 
 User-level presence only. **No elevated MSI**, no admin rights, no WiX

platform/linux/deb/build-deb.sh

@@ -5,13 +5,17 @@
 # Usage:
 #   ./platform/linux/deb/build-deb.sh [amd64|arm64|all]
 # Env:
-#   VERSION=0.1.2
+#   VERSION=0.3.6   # default: internal/job.HelperVersion
 #   BIN_AMD64=path/to/verae-print   BIN_ARM64=path/to/verae-print
 #   OUT=build/deb
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
-VERSION="${VERSION:-0.3.4}"
+# Package version = internal/job.HelperVersion (single source of truth).
+if [[ -z "${VERSION:-}" ]]; then
+  VERSION="$(grep -E 'HelperVersion[[:space:]]*=' "$ROOT/internal/job/job.go" | head -1 | sed -E 's/.*"([^"]+)".*/\1/')"
+fi
+VERSION="${VERSION:-0.3.6}"
 OUT="${OUT:-$ROOT/build/deb}"
 ARCHS="${1:-all}"
 PKG_NAME="verae-print"
@@ -181,7 +185,7 @@ resolve_bin() {
   local cand
   for cand in \
     "$ROOT/build/win-linux/VeraePrintStamp-${label}-${VERSION}/verae-print" \
-    "$ROOT/build/win-linux/VeraePrintStamp-${label}-0.1.2/verae-print" \
+    "$ROOT/build/win-linux/VeraePrintStamp-${label}/verae-print" \
     "$ROOT/build/linux-bins/verae-print-${arch}"
   do
     if [[ -f "$cand" ]]; then

platform/smoke-packaging-metadata.sh

@@ -117,6 +117,19 @@ else
   fi
 fi
 
+# Linux deb builder must resolve HelperVersion (no stale 0.3.x hard default).
+DEB_SH="$ROOT/platform/linux/deb/build-deb.sh"
+if [[ -f "$DEB_SH" ]]; then
+  if grep -q 'HelperVersion' "$DEB_SH" \
+    && grep -Fq "VERSION=\"\${VERSION:-$HELPER}\"" "$DEB_SH"; then
+    pass "deb build-deb.sh HelperVersion fallback=$HELPER"
+  else
+    bad "deb build-deb.sh missing HelperVersion path or fallback $HELPER"
+  fi
+else
+  bad "missing $DEB_SH"
+fi
+
 # Tray scripts must not implement IPP POST (pure GET presence).
 for f in \
   "$ROOT/platform/windows/scripts/verae-tray.ps1" \

site/printit.verae.ai/index.html

@@ -194,7 +194,7 @@
         <div class="row">
           <div>
             <h2>Debian / Ubuntu</h2>
-            <p><code>.deb</code> package 0.3.4 · <code>verae-print</code> + “Verae Timestamping” printer. Your first print opens a sign-in window to get your key.</p>
+            <p><code>.deb</code> package <strong>0.3.6</strong> (HelperVersion; published download builds may lag — see DOWNLOADS-MANIFEST) · <code>verae-print</code> + “Verae Timestamping” printer. Your first print opens a sign-in window to get your key.</p>
           </div>
           <div class="actions">
             <a class="btn btn-primary" href="/downloads/verae-print_amd64.deb">Download amd64.deb</a>