feat: add safe Gitea sync and signed updates

package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeflow",
-  "version": "0.10.12",
+  "version": "0.10.13",
   "private": true,
   "description": "Desktop release cockpit for local Git, Gitea Actions and controlled exact-commit deployments.",
   "main": "main.cjs",
@@ -14,7 +14,7 @@
     "coverage": "c8 --check-coverage --lines 85 --functions 85 --branches 68 --statements 85 node --test tests/*.test.mjs && npm run coverage:modules",
     "coverage:modules": "c8 report --check-coverage --per-file --include src/** --statements 60 --lines 60 --functions 50 --branches 36 --reporter=text-summary",
     "verify": "node scripts/verify.mjs",
-    "dist:win": "electron-builder --win nsis portable && node scripts/write-release-checksums.mjs && node scripts/verify-release-signatures.mjs && node scripts/prune-dist.mjs",
+    "dist:win": "electron-builder --win nsis portable && node scripts/write-release-checksums.mjs && node scripts/sign-release-manifest.mjs && node scripts/verify-release-signatures.mjs && node scripts/prune-dist.mjs",
     "dist:linux": "electron-builder --linux AppImage && node scripts/prune-dist.mjs",
     "dist:mac": "electron-builder --mac dmg && node scripts/prune-dist.mjs",
     "doctor": "node scripts/doctor.mjs",
@@ -24,6 +24,7 @@
     "test:browser": "playwright test",
     "test:browser:ci": "playwright test --reporter=line,html",
     "test:signing": "powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/test-authenticode-chain.ps1",
+    "signing:setup": "node scripts/setup-update-signing-key.mjs",
     "connections:check": "electron scripts/validate-installed-connections.cjs",
     "deployments:audit": "electron scripts/audit-installed-deployments.cjs",
     "release:binary": "electron scripts/publish-binary-release.cjs",
@@ -50,6 +51,7 @@
       "package.json",
       "build/icon.png",
       "build/icon.ico",
+      "build/update-signing-public.pem",
       "docs/SETUP_GUIDE.md",
       "docs/DIAGNOSTICS.md",
       "docs/STATUS_ENDPOINT.md",
@@ -67,6 +69,7 @@
       "scripts/apply-source-update.ps1",
       "scripts/apply-binary-update.ps1",
       "scripts/prune-dist.mjs",
+      "scripts/sign-release-manifest.mjs",
       "docs/RELEASE_NOTES_0.4.0.md",
       "docs/LUMAOPS_SERVER_AUDIT.md",
       "docs/SSH_UNRAID_DEPLOYMENT.md",
@@ -118,6 +121,7 @@
       "docs/RELEASE_NOTES_0.10.10.md",
       "docs/RELEASE_NOTES_0.10.11.md",
       "docs/RELEASE_NOTES_0.10.12.md",
+      "docs/RELEASE_NOTES_0.10.13.md",
       "docs/CURRENT_STATE.md",
       "docs/MUTATION_MODEL.md",
       "docs/RELEASING.md",