feat(release): publish desktop updates from a tag through one feed

Desktop clients had two competing update sources: the runtime pointed at a
legacy GitLab registry while the Forgejo packages were filled in by
hardcoded, version-pinned scripts. Operators could not tell which feed was
authoritative, and no release could be reproduced from a tag.

Auto-update now reads a single canonical Forgejo registry feed, updated by
a version-agnostic publisher that runs from the tag on Forgejo, GitLab, and
GitHub CI alike. Channel, minimum supported version, forced install,
full-versus-delta thresholds, staged rollout, and a remote kill switch come
from one policy file the client fetches alongside the feed. Tag creation is
gated on a clean tree, matching version surfaces, and a changelog section.

.forgejo/workflows/release.yml

@@ -0,0 +1,73 @@
+name: release
+
+# Canonical tag-triggered desktop release built and published on Forgejo.
+# GitLab CI (.gitlab-ci.yml) and GitHub Actions (.github/workflows/release.yml)
+# remain alternate builders; all three converge on publish-forgejo-release.mjs
+# so the Forgejo feed is the single update source.
+#
+# Required repository secrets:
+#   FORGEJO_TOKEN              — PAT with write:package + write:repository
+#   WIN_CSC_LINK               — base64 Authenticode PFX (public-trust)
+#   WIN_CSC_KEY_PASSWORD       — PFX password
+#   WIN_CSC_EXPECTED_SIGNER_SUBJECT — exact certificate subject
+# Release fails closed when signing material is absent.
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+
+jobs:
+  release-windows:
+    runs-on: windows
+    defaults: { run: { shell: pwsh } }
+    steps:
+      - name: checkout
+        env: { CI_TOKEN: "${{ github.token }}" }
+        run: |
+          $u = [Uri]$env:GITHUB_SERVER_URL
+          $url = "$($u.Scheme)://actions:$($env:CI_TOKEN)@$($u.Authority)/$($env:GITHUB_REPOSITORY).git"
+          if (-not (Test-Path .git)) { git init -q . }
+          if (git remote | Select-String -Quiet '^origin$') { git remote set-url origin $url } else { git remote add origin $url }
+          git fetch -q --depth 1 origin $env:GITHUB_REF
+          git checkout -q -f FETCH_HEAD
+          git clean -qfdx
+
+      - name: 버전 정본 대조
+        run: |
+          node scripts/ci/sync-version.mjs --check --tag "$env:GITHUB_REF_NAME"
+
+      - name: 의존성 설치
+        run: npm ci
+
+      - name: 데스크톱 빌드 (서명 필수)
+        env:
+          WIN_CSC_LINK: "${{ secrets.WIN_CSC_LINK }}"
+          WIN_CSC_KEY_PASSWORD: "${{ secrets.WIN_CSC_KEY_PASSWORD }}"
+          WIN_CSC_EXPECTED_SIGNER_SUBJECT: "${{ secrets.WIN_CSC_EXPECTED_SIGNER_SUBJECT }}"
+        run: |
+          if (-not $env:WIN_CSC_LINK -or -not $env:WIN_CSC_KEY_PASSWORD) {
+            throw "WIN_CSC_LINK / WIN_CSC_KEY_PASSWORD 가 없으면 stable 릴리스를 게시할 수 없습니다."
+          }
+          if ($env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -match '(?i)Everything2EverythingDev') {
+            throw "로컬 개발 인증서는 production 서명 identity가 아닙니다."
+          }
+          npm run build --workspace=@d3ro/desktop
+          Push-Location apps/desktop
+          npx electron-builder --win --x64 --config electron-builder.yml --publish never
+          Pop-Location
+
+      - name: Windows 산출물 검증
+        env:
+          WIN_CSC_EXPECTED_SIGNER_SUBJECT: "${{ secrets.WIN_CSC_EXPECTED_SIGNER_SUBJECT }}"
+        run: |
+          $releaseVersion = node -p "require('./release/product-version.json').version"
+          & scripts/ci/verify-windows-release-artifact.ps1 -ExpectedVersion $releaseVersion -ExpectedSignerSubject $env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -ReleaseDirectory "apps/desktop/release/$releaseVersion"
+
+      - name: Forgejo 릴리스 + feed 게시
+        env:
+          FORGEJO_TOKEN: "${{ secrets.FORGEJO_TOKEN }}"
+          FORGEJO_REPO: "${{ github.server_url }}/${{ github.repository }}"
+        run: |
+          node scripts/ci/publish-forgejo-release.mjs