feat: harden release signing and coverage gate

scripts/signed-electron-builder-config.cjs

@@ -0,0 +1,22 @@
+"use strict";
+
+const pkg = require("../package.json");
+
+const expectedPublisher = String(process.env.FORGEFLOW_EXPECTED_PUBLISHER || "").trim();
+const commonName = expectedPublisher.match(/^CN=([^,]+)/i)?.[1]?.trim();
+const useAzure = Boolean(String(process.env.FORGEFLOW_AZURE_SIGNING_ENDPOINT || "").trim());
+const win = { ...pkg.build.win, forceCodeSigning: true };
+
+if (useAzure) {
+  win.azureSignOptions = {
+    publisherName: commonName,
+    endpoint: process.env.FORGEFLOW_AZURE_SIGNING_ENDPOINT,
+    codeSigningAccountName: process.env.FORGEFLOW_AZURE_SIGNING_ACCOUNT,
+    certificateProfileName: process.env.FORGEFLOW_AZURE_CERTIFICATE_PROFILE,
+    fileDigest: "SHA256",
+    timestampDigest: "SHA256",
+    timestampRfc3161: "http://timestamp.acs.microsoft.com",
+  };
+}
+
+module.exports = { ...pkg.build, win };