feat(release): ship an install path that needs no code-signing certificate

Installers could not be published at all: the signing certificate does not
exist yet, and the release pipelines stop at their signing guard. Users had no
way to install a fixed build, so the product was effectively stuck behind a
certificate that takes weeks to obtain.

There is also a second, independent blocker: the download feed sits behind
Cloudflare, which rejects any upload body over about 100 MiB, and the app with
its speech engine exceeds that even when signed.

A portable channel now publishes what can actually be delivered today: the app
compressed into 95 MiB 7z volumes (162 MiB total instead of 243 MiB), a Scoop
bucket for a normal install and uninstall experience, and a verifiable manual
installer script. It is deliberately separate from the auto-update feed, needs
no certificate, and refuses to overwrite an already published version.

CHANGELOG.md

@@ -33,6 +33,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `sidecar:build`, plus a packaging-time bundle verifier that fails the build when the
   engine or its VAD data is missing.
 
+### Added
+- **Signing-free install path (`portable` channel)**: the canonical feed sits behind
+  Cloudflare, which rejects any upload body over ~100 MiB with HTTP 413 (measured:
+  60 MiB accepted, 110 MiB rejected). The sidecar-carrying app exceeds that, so releases
+  are now also published as 95 MiB 7z split volumes (688 MB app → 162 MiB) with a Scoop
+  bucket manifest and a verifiable manual installer script. This channel never touches the
+  auto-update feed and needs no Authenticode certificate, so users can install while the
+  signing certificate is still being procured.
+
 ### Changed
 - Local engine connections now target the IPv4 loopback (`127.0.0.1`) instead of
   `localhost`. On machines where `localhost` resolves only to IPv6, every local request