Add safe Windows desktop feed publication

Desktop/docs/windows-update-feed.md

@@ -36,11 +36,29 @@ feed with a concrete version:
 </QSfera>
 ```
 
-Validate the live feed before a Windows production release:
+From the repository root, prepare the feed XML from a signed MSI and optionally
+upload the MSI/feed to the web host:
 
 ```powershell
-./scripts/validate-desktop-update-feed.ps1 -Url "https://qsfera.kusoft.xyz/desktop/updates/stable.xml"
-./scripts/validate-production-release.ps1 -VerifyUpdateFeed
+.\scripts\package-windows-desktop.ps1
+.\scripts\publish-windows-desktop.ps1 -MsiPath ".\artifacts\windows-desktop\QSfera-Desktop-4.0.0-win-x64.msi"
+.\scripts\publish-windows-desktop.ps1 `
+  -MsiPath ".\artifacts\windows-desktop\QSfera-Desktop-4.0.0-win-x64.msi" `
+  -RemoteHost "192.168.0.185" `
+  -RemoteDownloadDirectory "/var/www/qsfera/desktop/downloads" `
+  -RemoteFeedPath "/var/www/qsfera/desktop/updates/stable.xml"
+```
+
+`publish-windows-desktop.ps1` refuses remote publication when the MSI is not
+Authenticode-signed. `-SkipSignatureCheck` is only for local feed validation and
+is rejected when `-RemoteHost` is set.
+
+From the repository root, validate the feed before a Windows production release:
+
+```powershell
+.\Desktop\scripts\validate-desktop-update-feed.ps1 -Url "https://qsfera.kusoft.xyz/desktop/updates/stable.xml"
+.\Desktop\scripts\validate-desktop-update-feed.ps1 -Path ".\artifacts\windows-desktop\publish\stable.xml"
+.\Desktop\scripts\validate-production-release.ps1 -VerifyUpdateFeed
 ```
 
 For a stable signed tag release, `validate-production-release.ps1 -RequireSigning`