DKR-R v1.0.9 - update signing handoff

The required filenames are DKR-R-update.json and DKR-R-update.sig. The second
is a 128-character hexadecimal Ed25519 signature over the exact first file.
Reusing v1.0.8's signature, editing its version or having the public key does
not permit signing a new update. Use the original private Ed25519 PEM key.
Never replace packaging/update-public-key.json to get around a missing key.

The Patch Pipeline wrapper update_assets.py reuses scripts/update_release.py,
the existing trust anchor, Windows file table/ownership rules and exact final
v1.0.9 package hashes. It adds no updater protocol or native change. Steam Deck
uses linux-x86_64. No new Apple package is in this build set.

First commit the complete release source, including the accepted authored
patch layers. Use its actual full SHA; an older HEAD omitting native inputs
does not identify these binaries. The wrapper checks that the current source
matches the selected commit. Local Worker caches and earlier discovery plans
are not release inputs. VERSION must be the actual stable 1.0.9 value.

Review without a private key:
python -B patches/release-prep/v1.0.9/update_assets.py prepare
  --packages <finished-release-folder> --commit <40-character-source-commit>
  --output <fresh-review-folder>

This writes DKR-R-update.UNSIGNED.json, deliberately not an installable pair.
Keep it out of published release assets. No fake .sig is produced.

With the existing private key available outside the repo/release folders:
python -B patches/release-prep/v1.0.9/update_assets.py sign
  --packages <finished-release-folder> --commit <40-character-source-commit>
  --private-key <protected-original-key.pem> --output <fresh-signing-folder>

The wrapper locates OpenSSL on PATH or the normal Git for Windows path. The
unchanged signer rejects a key not matching the installed trust anchor before
writing either asset. Encrypted keys require the owner's protected local unlock;
never put a password or private key contents in chat, scripts or GitHub assets.
The wrapper verifies the fresh signature, canonical manifest, all package hashes
and Windows ownership/file table, then writes DKR-R-update-VERIFICATION.json.

Verify again before publication:
python -B patches/release-prep/v1.0.9/update_assets.py verify
  --packages <finished-release-folder> --output <signed-pair-folder>

Upload the five qualified native packages and BOTH signed files to a draft
GitHub release whose tag is exactly Version1.0.9, targeting the same committed
release source. Publish only after the real updater/install and device checks.
Do not edit/recompress packages or JSON after signing, mix in older assets or
overwrite an already published version. The signing wrapper does not push,
create tags, upload, publish, deploy, or execute a game/helper/test/AppImage.
See docs/UPDATES.md and RELEASE-VALIDATION.md.
