feat: establish reproducible FreeCAD web compatibility baseline

scripts/sign-release-artifacts.mjs

@@ -0,0 +1,13 @@
+import { spawnSync } from 'node:child_process'
+import { resolve } from 'node:path'
+import { loadControlledSigningKey } from './release-signing-key.mjs'
+
+const root = resolve(new URL('..', import.meta.url).pathname)
+const key = await loadControlledSigningKey()
+const result = spawnSync(process.execPath, [resolve(root, 'scripts/generate-release-artifacts.mjs'), ...process.argv.slice(2)], {
+  cwd: root,
+  env: { ...process.env, RELEASE_SIGNING_PRIVATE_KEY: key.privateKeyPem, RELEASE_SIGNING_KEY_ID: key.keyId },
+  stdio: 'inherit',
+})
+if (result.error) throw result.error
+process.exit(result.status ?? 1)