Prepare ForgeFlow for public release

docs/SECURITY.md

@@ -23,7 +23,7 @@ flexibility.
 - session-only fallback when OS encryption is unavailable;
 - token omitted from renderer-visible public state;
 - encrypted token blob excluded from diagnostic bundles;
-- blank settings token field preserves the existing token;
+- a blank settings token field preserves the existing token only when the normalized Gitea origin is unchanged;
 - atomic config replacement and restrictive permissions where supported;
 - service URLs reject embedded user credentials;
 - no token is required by setup/build scripts or documentation.
@@ -128,9 +128,10 @@ included model uses:
   require the exact user-confirmed pinned fingerprint;
 - remote folders and Compose paths are validated against traversal;
 - tracked server-side changes block exact-SHA reset;
-- updater tokens are sent only to the configured Gitea origin;
+- updater tokens are sent only to the configured Gitea origin, and changing that origin requires a newly entered token;
 - non-loopback Gitea connections require HTTPS;
 - packaged updates require a publisher-signed Ed25519 manifest that binds the
   source commit, artifact identity, byte length and SHA-256 digest;
-- update archives are checksummed and validated by the full local quality gate;
-- source backup is restored when an update fails.
+- packaged update bytes are rehashed immediately before apply;
+- integrated source replacement is disabled until source archives carry the
+  same independent publisher signature.