feat: add safe Gitea sync and signed updates

docs/RELEASING.md

@@ -19,11 +19,13 @@ no certificate, Azure or other paid-service dependency:
 npm run dist:win
 ```
 
-This produces the installer and portable executable, SHA-256 sidecars, a
-CycloneDX SBOM and provenance evidence. The in-app updater downloads only the
-matching Gitea release asset, checks its Windows executable format and verifies
-the published SHA-256 digest before staging it. The update helper verifies the
-digest again immediately before replacing the installed executable.
+Run `npm run signing:setup` once on the release workstation. It stores the
+private Ed25519 key outside the repository and writes only its public key into
+the packaged app. `npm run dist:win` then produces the installer and portable
+executable, SHA-256 sidecars, CycloneDX SBOM, provenance and an Ed25519-signed
+manifest bound to the exact source commit. The updater verifies the pinned
+publisher key before trusting the artifact digest and verifies that digest again
+immediately before replacing the installed executable.
 
 Windows can display an `Unknown publisher` warning for an unsigned installer.
 That warning concerns public publisher reputation; it does not prevent ForgeFlow
@@ -34,9 +36,9 @@ correct operation.
 ## Atomic publication
 
 `npm run release:binary` keeps the Gitea release in draft state while uploading
-the installer, portable executable, two checksums, provenance and SBOM. It only
-publishes after all six assets are present. A failed upload leaves a draft rather
-than exposing an incomplete updater target.
+the installer, portable executable, two checksums, provenance, SBOM, signed
+manifest and signature. It only publishes after all eight assets are present. A
+failed upload leaves a draft rather than exposing an incomplete updater target.
 
 The optional signing acceptance fixture can still validate the complete local
 Authenticode chain without purchasing or retaining a certificate: