feat: add signed Windows launcher self-updates with SHA-256 verification

patcher.js

@@ -91,14 +91,62 @@ class Patcher {
     }
   }
 
+  integrityPath() {
+    return path.join(this.appDataPath, 'integrity.json');
+  }
+
+  readIntegrity() {
+    try {
+      return JSON.parse(fs.readFileSync(this.integrityPath(), 'utf8'));
+    } catch (e) {
+      return {};
+    }
+  }
+
+  writeIntegrity(names) {
+    const all = this.readIntegrity();
+    for (const name of names) {
+      if (name !== 'frontend' && name !== 'player') continue;
+      const files = {};
+      const walk = (dir, rel) => {
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+          const full = path.join(dir, entry.name);
+          const r = `${rel}/${entry.name}`;
+          if (r.includes('/node_modules/@vyla-entertainment/sdk')) continue;
+          if (entry.isDirectory()) walk(full, r);
+          else if (entry.isFile()) files[r] = fs.statSync(full).size;
+        }
+      };
+      walk(path.join(this.appDataPath, name), name);
+      all[name] = files;
+    }
+    const tmp = `${this.integrityPath()}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(all), 'utf8');
+    renameSafe(tmp, this.integrityPath());
+  }
+
+  integrityOk(name) {
+    const files = this.readIntegrity()[name];
+    if (!files) return true;
+    for (const [rel, size] of Object.entries(files)) {
+      try {
+        if (fs.statSync(path.join(this.appDataPath, rel)).size !== size) return false;
+      } catch (e) {
+        return false;
+      }
+    }
+    return true;
+  }
+
   componentIntact(name) {
     const probe = COMPONENT_PROBES[name];
     if (!probe || name === 'secrets') return true;
     try {
-      return fs.statSync(path.join(this.appDataPath, probe)).size > 0;
+      if (fs.statSync(path.join(this.appDataPath, probe)).size <= 0) return false;
     } catch (e) {
       return false;
     }
+    return this.integrityOk(name);
   }
 
   staleComponents(release) {