feat: add safe Gitea sync and signed updates

tests/renderer-workflow.test.mjs

@@ -121,6 +121,49 @@ test("repository troubleshooting offers personalized synchronization repair acti
   assert.match(ipc, /repository:repair-sync/);
 });
 
+test("Gitea workspace sync is preview-driven, recoverable and never deletes ignored runtime data", async () => {
+  const renderer = await rendererSource();
+  const preload = await readFile(new URL("../preload.cjs", import.meta.url), "utf8");
+  const ipc = await ipcSource();
+  assert.match(renderer, /Gitea workspace sync/);
+  assert.match(renderer, /preview-workspace-sync/);
+  assert.match(renderer, /confirm-workspace-sync/);
+  assert.match(renderer, /Ignored runtime files remain in place/);
+  assert.match(renderer, /recovery branch/);
+  assert.match(renderer, /named Git stash/);
+  assert.match(renderer, /Gitea fetch interval/);
+  assert.match(preload, /previewWorkspaceSync/);
+  assert.match(preload, /applyWorkspaceSync/);
+  assert.match(ipc, /repository:workspace-sync-preview/);
+  assert.match(ipc, /repository:workspace-sync-apply/);
+});
+
+test("demo bridge implements the complete Git recovery flow", async () => {
+  const source = await readFile(
+    new URL("../src/renderer/mock-repository-bridge.js", import.meta.url),
+    "utf8",
+  );
+  for (const method of [
+    "gitRecoveryStatus",
+    "reconcileRepository",
+    "repairGitLocks",
+    "repairRepositorySync",
+  ]) {
+    assert.match(source, new RegExp(`async ${method}\\(`));
+  }
+});
+
+test("Git tools rows retain their content height inside the scrollable tab", async () => {
+  const styles = await readFile(
+    new URL("../src/renderer/styles.css", import.meta.url),
+    "utf8",
+  );
+  assert.match(
+    styles,
+    /\.git-tools-grid\s*\{[^}]*grid-auto-rows:\s*max-content/s,
+  );
+});
+
 test("advanced Git, desktop, backup, policy and audit workflows are exposed in the renderer", async () => {
   const renderer = await rendererSource();
   const preload = await readFile(