CONFIG=<path> copied the file to /tmp under its own basename, while the remote
half installed /tmp/fingerprintd.json. A config named anything else therefore
left the PREVIOUS deploy's fingerprintd.json in place and installed that, while
printing ">> config installed" either way.
It went unnoticed until the printed config hash did not move after a deliberate
change, which is the only reason the hashes are printed at all. An experiment had
already been deployed against the wrong config by then.
The file now crosses under a fixed name, and a deploy with no CONFIG removes any
stale one on the phone rather than leaving something for a later run to pick up
by accident.