release: prepare 0.6.2 Linux and Windows packages

docs/gitea-release.md

@@ -2,7 +2,8 @@
 
 The release destination is
 https://git.sorokin-oleg-edu.xyz/sorokin.oleg.edu/learnharness.
-Version **0.6.1 is Linux x64 AppImage-only**; follow the dedicated procedure below.
+Version **0.6.2 targets Linux x64 AppImage and Windows x64 NSIS**; follow the
+dedicated procedure below. Version 0.6.1 was Linux x64 AppImage-only.
 The historical **0.6.0 release targets Linux x64 and Windows x64**, with each platform built
 and verified on its native operating system. The upstream GitHub workflow and three-platform packaging
 configuration remain available as reference in `.github/workflows/release.yml`
@@ -19,7 +20,65 @@ Gitea's `latest` alias resolves the most recent published, non-prerelease releas
 Drafts do not become updates. The repository and published downloads must be
 public; no API credential is embedded in the application.
 
-## 0.6.1: Linux x64 AppImage-only upload and verification
+## 0.6.2: Linux AppImage and Windows installer
+
+Build both platforms from the same release commit with Node 26. Use a clean
+checkout on each native operating system so local credentials, environment
+files, application data, and older packages cannot enter the standalone payload.
+The Windows installer retains the existing unsigned per-user NSIS configuration.
+
+After dependency installation, run the typecheck, deterministic tests, lint,
+native renderer tests, and standalone runtime smoke checks. Include
+`tests/desktop-logger.test.ts` under each platform's bundled Electron Node to
+exercise the broken-pipe and retention regressions in the shipped runtime.
+Curate the standalone payload with `node scripts/build-server.mjs`, then package:
+
+```sh
+# Native Linux checkout
+npx electron-builder --config electron-builder.gitea.yml --linux AppImage --x64 --publish never
+
+# Native Windows checkout
+npx electron-builder --config electron-builder.gitea.yml --win --x64 --publish never
+```
+
+Verify each packaged updater with `scripts/gitea-release.mjs verify-package` and
+run the provider, server, and browser-helper smoke checks against that package's
+own standalone tree and executable. Copy only these six assets into a staging
+directory (the checksum command creates the final file):
+
+- `LearnHarness-0.6.2-x86_64.AppImage`
+- `LearnHarness-0.6.2-x64-setup.exe`
+- `LearnHarness-0.6.2-x64-setup.exe.blockmap`
+- `latest-linux.yml`
+- `latest.yml`
+- `SHA256SUMS`
+
+```sh
+node scripts/gitea-release.mjs checksums /path/to/staging --appimage-windows
+node scripts/gitea-release.mjs verify /path/to/staging --appimage-windows
+```
+
+This explicit scope preserves the historical Linux defaults and AppImage-only
+mode. It rejects extra staged files, checks both installer headers and updater
+feeds against the actual bytes, regenerates the Windows blockmap with the pinned
+packager to verify every chunk and full installer coverage, and verifies the
+combined SHA-256 manifest. It includes no Debian, RPM, or macOS packages.
+
+Commit and push the release source and its matching annotated `v0.6.2` tag.
+Supply the Gitea API token privately, then prepare and verify the draft:
+
+```sh
+node scripts/gitea-release.mjs upload /path/to/staging --appimage-windows
+node scripts/gitea-release.mjs verify-remote /path/to/staging --appimage-windows
+```
+
+The uploader reads notes from `docs/release-0.6.2.md`, requires the remote tag,
+keeps the release a stable draft, and downloads all six attachments to compare
+their SHA-256 hashes with the validated local files. It refuses published or
+ambiguous releases and mismatched existing attachments. Publication follows
+human review of the completed draft.
+
+## Historical 0.6.1: Linux x64 AppImage-only upload and verification
 
 This release has exactly three attachments: