feat: add safe Gitea sync and signed updates

Publish-Missing-Binary-Release.ps1

@@ -73,7 +73,11 @@ try {
       "ForgeFlow-Setup-$version-win-x64.exe",
       "ForgeFlow-Setup-$version-win-x64.exe.sha256",
       "ForgeFlow-Portable-$version-win-x64.exe",
-      "ForgeFlow-Portable-$version-win-x64.exe.sha256"
+      "ForgeFlow-Portable-$version-win-x64.exe.sha256",
+      "ForgeFlow-$version-provenance.json",
+      "ForgeFlow-$version-sbom.cdx.json",
+      "ForgeFlow-$version-release-manifest.json",
+      "ForgeFlow-$version-release-manifest.json.sig"
     )
     foreach ($assetName in $expectedAssets) {
       $assetPath = Join-Path $clone "dist\$assetName"