Walks a client directory, sha256-hashes every file, emits a canonical JSON manifest matching docs/update-manifest.md. Excludes runtime artifacts (.log, .dxvk-cache, .pdb, .old) and the launcher is broken out as a top-level field rather than an entry in files[]. Does not sign; pair with a separate signer step.