download_missing must fetch record.json too (.bin-only filter broke restore); rehearsal pre-cleans stale test repo

stage listing raises instead of returning {}; empty-repo case handled explicitly; verify refuses manifest-less PASS; +val holdout in merge

hubsync.ensure_repo must install creds first (real cause of the 401); correct E-017 diagnosis

hub sync for staged sources + cold-resume rehearsal script