feat(release): ship an install path that needs no code-signing certificate

Installers could not be published at all: the signing certificate does not
exist yet, and the release pipelines stop at their signing guard. Users had no
way to install a fixed build, so the product was effectively stuck behind a
certificate that takes weeks to obtain.

There is also a second, independent blocker: the download feed sits behind
Cloudflare, which rejects any upload body over about 100 MiB, and the app with
its speech engine exceeds that even when signed.

A portable channel now publishes what can actually be delivered today: the app
compressed into 95 MiB 7z volumes (162 MiB total instead of 243 MiB), a Scoop
bucket for a normal install and uninstall experience, and a verifiable manual
installer script. It is deliberately separate from the auto-update feed, needs
no certificate, and refuses to overwrite an already published version.

.forgejo/workflows/portable.yml

@@ -0,0 +1,69 @@
+name: portable-unsigned
+
+# 서명 없는 휴대용 배포 채널.
+#
+# 배경: NSIS/MSIX 설치본은 public-trust Authenticode 서명이 필수라 인증서가 없는 동안
+# 게시할 수 없다(실측: 릴리스 파이프라인 2회 모두 서명 가드에서 실패). 이 워크플로는
+# 인증서 없이 동작하는 7z 분할 볼륨 + Scoop 채널을 게시한다.
+#
+# 안전 규칙:
+#   - 자동 업데이트 피드(latest.yml / update-policy.json)를 절대 건드리지 않는다.
+#   - 파일명에 -portable 을 두어 서명된 릴리스 자산과 혼동되지 않게 한다.
+#   - Cloudflare 업로드 한도(100MiB)를 넘지 않게 95MiB 볼륨으로 나누어 게시한다.
+#
+# 필요한 시크릿: FORGEJO_TOKEN (write:package)
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+
+jobs:
+  portable-windows:
+    runs-on: windows
+    defaults: { run: { shell: pwsh } }
+    steps:
+      - name: checkout
+        env: { CI_TOKEN: "${{ github.token }}" }
+        run: |
+          $u = [Uri]$env:GITHUB_SERVER_URL
+          $url = "$($u.Scheme)://actions:$($env:CI_TOKEN)@$($u.Authority)/$($env:GITHUB_REPOSITORY).git"
+          if (-not (Test-Path .git)) { git init -q . }
+          if (git remote | Select-String -Quiet '^origin$') { git remote set-url origin $url } else { git remote add origin $url }
+          git fetch -q --depth 1 origin $env:GITHUB_REF
+          git checkout -q -f FETCH_HEAD
+          git clean -qfdx
+
+      - name: 버전 정본 대조
+        run: |
+          node scripts/ci/sync-version.mjs --check --tag "$env:GITHUB_REF_NAME"
+
+      - name: 의존성 설치
+        run: npm ci
+
+      - name: STT 사이드카 빌드
+        run: |
+          npm run sidecar:setup --workspace=@d3ro/desktop
+          npm run sidecar:build --workspace=@d3ro/desktop
+          node scripts/ci/verify-sidecar-bundle.mjs
+
+      - name: 데스크톱 번들 빌드
+        run: npm run build --workspace=@d3ro/desktop
+
+      - name: 휴대용 ZIP + Scoop 매니페스트 생성
+        run: node scripts/ci/build-portable.mjs
+
+      - name: Forgejo portable 채널 게시
+        env:
+          FORGEJO_TOKEN: "${{ secrets.FORGEJO_TOKEN }}"
+        run: node scripts/ci/publish-portable-release.mjs
+
+      - name: 아티팩트 업로드
+        uses: actions/upload-artifact@v4
+        with:
+          name: d3ro-voice-portable-${{ github.ref_name }}
+          path: |
+            apps/desktop/release/*/*-portable.7z.00*
+            apps/desktop/release/*/portable.json
+            bucket/d3ro-voice.json