ForgeFlow-Public/docs/RELEASE_NOTES_0.10.2.md

ForgeFlow 0.10.2

Packaged updater origin repair

• Gitea release assets that expose an internal HTTP ROOT_URL are safely rewritten to ForgeFlow's configured public HTTPS Gitea origin.
• Authentication remains same-origin: the Gitea token is never forwarded to an internal address, CDN or unrelated redirect target.
• Published Windows executables are still validated as PE files and against their release SHA-256 sidecars before staging.
• The live authenticated updater acceptance downloads the exact published installer and proves its byte count and SHA-256 digest.