v2.0.0: first signed-update release

First production release through the signed-manifest auto-updater.
See docs/guides/UPDATER_DEPLOYMENT.md for the rollout flow.