feat: add fail-closed signed release provenance

tests/update-service.test.mjs

@@ -507,6 +507,27 @@ test("packaged updater rejects a binary whose checksum does not match", async ()
   await rm(temp, { recursive: true, force: true });
 });
 
+test("Windows release pipeline fails closed on signatures and emits provenance plus SBOM", async () => {
+  const [pkgSource, signatureSource, checksumSource] = await Promise.all([
+    readFile(new URL("../package.json", import.meta.url), "utf8"),
+    readFile(new URL("../scripts/verify-release-signatures.mjs", import.meta.url), "utf8"),
+    readFile(new URL("../scripts/write-release-checksums.mjs", import.meta.url), "utf8"),
+  ]);
+  assert.match(pkgSource, /verify-release-signatures\.mjs/);
+  assert.match(signatureSource, /FORGEFLOW_SIGNED_RELEASE/);
+  assert.match(signatureSource, /FORGEFLOW_EXPECTED_PUBLISHER/);
+  assert.match(signatureSource, /TimestampSubject/);
+  assert.match(signatureSource, /Signed release verification failed/);
+  assert.match(checksumSource, /provenance\.json/);
+  assert.match(checksumSource, /sbom\.cdx\.json/);
+  assert.match(checksumSource, /CycloneDX/);
+  const publisher = await readFile(new URL("../scripts/publish-binary-release.cjs", import.meta.url), "utf8");
+  assert.match(publisher, /draft: true/);
+  assert.match(publisher, /requiredAssets/);
+  assert.match(publisher, /Release remains draft because required assets are missing/);
+  assert.match(publisher, /sbom\.cdx\.json/);
+});
+
 test("binary update helper verifies, waits, applies and records restart state", async () => {
   const helper = await readFile(
     new URL("../scripts/apply-binary-update.ps1", import.meta.url),