feat(companion): add optional signing for release bundle artifacts

docs/operations/COMPANION_RELEASE_BUNDLE.md

@@ -21,6 +21,21 @@ Generated files:
 - `README.md`
 - `CHECKSUMS.sha256`
 
+Optional signed export:
+
+```bash
+flynn companion \
+  --platform macos \
+  --node-id companion-macbook \
+  --export-release-bundle ./dist/companion-macos \
+  --signing-key ./keys/release-private.pem \
+  --signing-key-id team-k1
+```
+
+Additional file:
+
+- `CHECKSUMS.sha256.sig`
+
 ## Generate Platform Starter Shell Template
 
 For native app bootstrapping (without launcher/checksum artifacts), export a platform template:
@@ -51,6 +66,8 @@ Expected result:
 
 - all bundle files report `OK`
 
+If signature is present, verify `CHECKSUMS.sha256.sig` with your org signing key policy before launch.
+
 ## Launch
 
 ```bash