Thanks for replies. Now I know what went wrong: .org/release doesn't only list -stable channel versions, but also -beta, and I didn't carefully read...
(instead I just took the first device match, but instad should have looked at https://grapheneos.org/releases#tangorpro-stable explicitly. Following the release announcement link and scrolling up first lists the -beta channel versions, which isn't clearly separated from the -release channel list. At least not clearly enough for slipshod readers like me - maybe turn it into a table - one column for -release and the column next to it showning -beta?).
@Dumdum, the "promotional" mode ('releases' landing in -beta before beeing promoted to -stable) is perfectly fine and well known and understood, and also that there's only one version to install via 'System Updater' - the latest one. But I dislike the 'surprise' mode of the 'System Updater'.
Most appreciated would be showing at least the version info in the notification of the download that's ongoing (maybe together with additional meaningful info like "Incremental update V1 -> V2: size in MiB"). And I would very much like to have the choice whether I want to start the download or just digest the notice! And - most important, like initially mentioned a config option which defines to require user-interaction before establishing any network connection from the 'System Updater'. This could be a scheduled notification like "System Updater wants to look for updated releases in var.yourbranch, press OK to proceed". Something similar to the 'update succeeded, reboot now' message.
@GrapheneOS, even if I don't save bandwidth resp. total ammount of transferred packets, I sometimes want to avoid downtimes.
The donwtime today was superfluous. It was my own fault because I could have found the required info to avoid, so I have no reason to complain, but not needing to disable the 'System Updater' in order to avoid flashy traffic patterns would be highly appreciated - I guess I'm not alone with that.
Thanks, happy -stable move!