feat: harden release signing and coverage gate

tests/update-service.test.mjs

@@ -528,6 +528,22 @@ test("Windows release pipeline fails closed on signatures and emits provenance p
   assert.match(publisher, /sbom\.cdx\.json/);
 });
 
+test("production signing build supports classic and Azure identities but always fails closed", async () => {
+  const [pkg, validator, signedConfig] = await Promise.all([
+    readFile(new URL("../package.json", import.meta.url), "utf8"),
+    readFile(new URL("../scripts/validate-signing-environment.mjs", import.meta.url), "utf8"),
+    readFile(new URL("../scripts/signed-electron-builder-config.cjs", import.meta.url), "utf8"),
+  ]);
+  assert.match(pkg, /dist:win:signed/);
+  assert.match(validator, /FORGEFLOW_SIGNED_RELEASE/);
+  assert.match(validator, /WIN_CSC_LINK/);
+  assert.match(validator, /FORGEFLOW_AZURE_CERTIFICATE_PROFILE/);
+  assert.match(validator, /exact certificate subject/);
+  assert.match(signedConfig, /forceCodeSigning:\s*true/);
+  assert.match(signedConfig, /azureSignOptions/);
+  assert.match(signedConfig, /timestamp\.acs\.microsoft\.com/);
+});
+
 test("binary update helper verifies, waits, applies and records restart state", async () => {
   const helper = await readFile(
     new URL("../scripts/apply-binary-update.ps1", import.meta.url),