Prepare ForgeFlow for public release

docs/ARCHITECTURE.md

@@ -212,8 +212,8 @@ and last exit code. See `STATUS_ENDPOINT.md`.
 
 ## v0.4 services
 
-- `UpdateService` reads `package.json` at an exact Gitea branch SHA, downloads an
-  authenticated archive and launches the rollback-capable Windows source updater.
+- `UpdateService` reports `package.json` at an exact Gitea branch SHA, refuses
+  unsigned source replacement and applies only publisher-signed packaged updates.
 - `SshService` provides pinned-host SSH execution with encrypted password or
   private-key passphrase storage.
 - `UnraidDeploymentService` inspects existing application folders and performs