chore(scoop): bump packaged manifest to 0.11.0

[ivanlinhf]

What does this PR do?

Sync pkg/scoop/codebase-memory-mcp.json with the Scoop Main bucket manifest for 0.11.0 (add arm64, notes, and matching URLs/hashes). Packaging-only; no production code changes.

Written with an AI agent acting on behalf of @ivanlinhf.

Fixes #2300

Checklist

• Every commit is signed off (git commit -s) — required, CI rejects
  unsigned commits (DCO, see CONTRIBUTING.md)
• Tests pass locally (make -f Makefile.cbm test)
• Lint passes (make -f Makefile.cbm lint-ci)
• New behavior is covered by a test (reproduce-first for bug fixes)

N/A for test/lint: JSON packaging manifest only.

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[DeusData]

Thank you — the Scoop manifest was badly out of date, and I checked your hashes against the v0.11.0 release asset digests: both the amd64 and the arm64 zip match.

Two small things, and then it merges:

1. The version-metadata contract. Every red job is the same line: pkg/scoop/codebase-memory-mcp.json declares 0.11.0 but is pinned at 0.8.1, from tests/test_version_metadata_contract.sh. Please update that entry to "pkg/scoop/codebase-memory-mcp.json|pin:0.11.0" and its reason text to "last re-pinned for v0.11.0". The shard-completeness and aggregate reds follow from that one failure.
2. Keep an anchored find regex in autoupdate.hash. checksums.txt also lists ...-windows-amd64.zip.bundle and ...-ui-windows-amd64.zip, so Scoop's default filename search could pick the wrong line.

Optional: keeping the original two-space indentation would make the diff show only the real changes. Thank you again.