build(release): 加固 v0.1.0 桌面发布链路 (#3)

frontend/scripts/verify-desktop-release.mjs

@@ -392,6 +392,7 @@ const verifyWorkflowGates = async () => {
   assert(packageInfo.engines?.node === ">=22.13.0", "package.json must require Node.js >=22.13.0.");
   const requiredScripts = [
     "desktop:build:macos-release",
+    "desktop:build:windows-release",
     "desktop:update-feed:create",
     "desktop:update-feed:check",
     "desktop:release-readiness:check",
@@ -424,15 +425,30 @@ const verifyWorkflowGates = async () => {
 
   const releaseWorkflow = await readFile(resolve(rootDir, ".github/workflows/desktop-release-candidate.yml"), "utf8");
   const requiredReleaseWorkflowTokens = [
+    "runs-on: macos-latest",
+    "runs-on: windows-latest",
     "REQUIRE_DESKTOP_SIGNING",
+    "REQUIRE_WINDOWS_SIGNING",
     "TAURI_SIGNING_PRIVATE_KEY",
     "APPLE_ID",
     "APPLE_PASSWORD",
     "APPLE_TEAM_ID",
+    "WINDOWS_CERTIFICATE",
+    "WINDOWS_CERTIFICATE_PASSWORD",
+    "WINDOWS_TIMESTAMP_URL",
+    "npm audit",
     "npm run desktop:build:macos-release",
+    "npm run desktop:build:windows-release",
+    "Get-AuthenticodeSignature",
+    "EnhancedKeyUsageList",
+    "TimeStamperCertificate",
+    ".nsis.zip",
     "npm run desktop:update-feed:create",
+    "--platform-artifact",
     "npm run desktop:update-feed:check",
+    "--require-platform windows-x86_64",
     "npm run desktop:release-readiness:check",
+    "actions/download-artifact",
     "actions/upload-artifact",
   ];