feat(release): ship an install path that needs no code-signing certificate

Installers could not be published at all: the signing certificate does not
exist yet, and the release pipelines stop at their signing guard. Users had no
way to install a fixed build, so the product was effectively stuck behind a
certificate that takes weeks to obtain.

There is also a second, independent blocker: the download feed sits behind
Cloudflare, which rejects any upload body over about 100 MiB, and the app with
its speech engine exceeds that even when signed.

A portable channel now publishes what can actually be delivered today: the app
compressed into 95 MiB 7z volumes (162 MiB total instead of 243 MiB), a Scoop
bucket for a normal install and uninstall experience, and a verifiable manual
installer script. It is deliberately separate from the auto-update feed, needs
no certificate, and refuses to overwrite an already published version.

package.json

@@ -26,6 +26,9 @@
     "release:forgejo:local": "node --env-file-if-exists=.env scripts/ci/publish-forgejo-release.mjs",
     "release:forgejo:check": "node scripts/ci/publish-forgejo-release.mjs --check",
     "release:tag": "node scripts/ci/create-release-tag.mjs",
+    "release:portable:build": "node scripts/ci/build-portable.mjs",
+    "release:portable:check": "node scripts/ci/publish-portable-release.mjs --check",
+    "release:portable": "node --env-file-if-exists=.env scripts/ci/publish-portable-release.mjs",
     "release:secrets": "node --env-file-if-exists=.env scripts/ci/set-forgejo-secrets.mjs --write",
     "release:secrets:check": "node scripts/ci/set-forgejo-secrets.mjs --check",
     "security:secrets": "node scripts/ci/check-no-hardcoded-secrets.mjs",