feat(update): add verifiable release manifest

scripts/build_exe.ps1

@@ -153,8 +153,9 @@ $releaseRoot = Join-Path $repoRoot "release"
 $releaseName = "$appName$appVersion"
 $releaseDir = Join-Path $releaseRoot $releaseName
 $portableZip = Join-Path $releaseRoot "$releaseName.zip"
+$releaseMetadata = Join-Path $releaseRoot "release-metadata.json"
 
-foreach ($path in @($releaseDir, $portableZip)) {
+foreach ($path in @($releaseDir, $portableZip, $releaseMetadata)) {
     Assert-InProject -Path $path
     if (Test-Path -LiteralPath $path) {
         Remove-Item -LiteralPath $path -Recurse -Force
@@ -181,9 +182,18 @@ $readme = @(
 Set-Content -LiteralPath (Join-Path $releaseDir "README.txt") -Value $readme -Encoding UTF8
 
 Assert-NoExcludedData -Root $releaseDir -Excluded $excluded
+& $pythonExe @pythonArgs -m app.release_manifest manifest --release-dir $releaseDir --version $appVersion
+if ($LASTEXITCODE -ne 0) {
+    throw "生成 package-manifest.json 失败，退出码: $LASTEXITCODE"
+}
 Compress-ArchiveWithRetry -SourcePath (Join-Path $releaseDir "*") -DestinationPath $portableZip
+& $pythonExe @pythonArgs -m app.release_manifest metadata --zip $portableZip --version $appVersion --output $releaseMetadata
+if ($LASTEXITCODE -ne 0) {
+    throw "生成 release-metadata.json 失败，退出码: $LASTEXITCODE"
+}
 
 Write-Host "$(Decode-Utf8Base64 "5p6E5bu65a6M5oiQOg==") $exePath"
 Write-Host "$(Decode-Utf8Base64 "5Y+R5biD55uu5b2VOg==") $releaseDir"
 Write-Host "$(Decode-Utf8Base64 "5L6/5pC65Y6L57yp5YyFOg==") $portableZip"
+Write-Host "发布元数据: $releaseMetadata"
 Write-Host (Decode-Utf8Base64 "5LiN6KaB5oqK5pys5ZywIGRhdGHjgIHphY3nva7jgIHmlbDmja7lupPjgIHlm77niYfjgIHml6Xlv5fmiJbnmbvlvZXmgIHlpI3liLbov5vlj5HluIPljIXjgII=")