Stabilize Windows release CI

This commit hardens the release workflow against transient Electron binary download failures by switching Electron and electron-builder downloads to the npmmirror mirror and adding a single retry around the SignPath packaging step. This addresses intermittent TLS disconnects during CI builds without changing the release process itself.

.github/workflows/release.yml

@@ -78,6 +78,11 @@ jobs:
       # 内部测试阶段：SignPath 年度配额（约 500MB）耗尽时跳过签名、照常发布（产物未签名）。
       # ⚠️ 正式发布请删除此行并升级 SignPath 套餐（同时建议 SIGNPATH_ONLY_INSTALLER=false 全量签名）。
       SIGNPATH_SKIP_ON_QUOTA: 'true'
+      # Electron 二进制 / electron-builder 辅助工具下载源：
+      # GitHub release-assets.githubusercontent.com 偶发 TLS 断连（本次 CI 即失败于此），
+      # 统一走 npmmirror 镜像更稳（对 pnpm install 的 electron postinstall 同样生效）。
+      ELECTRON_MIRROR: https://npmmirror.com/mirrors/electron/
+      ELECTRON_BUILDER_BINARIES_MIRROR: https://npmmirror.com/mirrors/electron-builder-binaries/
     steps:
       - uses: actions/checkout@v4
         with:
@@ -131,8 +136,17 @@ jobs:
           }
 
       # 关键步骤：win.sign 自定义签名（SignPath）在打包过程中逐个签名内部 exe 与 setup.exe
+      # 失败重试 1 次：Electron 二进制下载偶发 TLS 断连，重试只补下载缺失部分（已成功的 zip 会进缓存）
       - name: Package & sign (SignPath)
-        run: pnpm exec electron-builder --win --publish never
+        shell: pwsh
+        run: |
+          for ($attempt = 1; $attempt -le 2; $attempt++) {
+            pnpm exec electron-builder --win --publish never
+            if ($LASTEXITCODE -eq 0) { break }
+            Write-Host "electron-builder 打包失败（第 $attempt 次，exit=$LASTEXITCODE），5 秒后重试..."
+            if ($attempt -eq 2) { exit $LASTEXITCODE }
+            Start-Sleep -Seconds 5
+          }
 
       - name: Generate Chinese release notes
         shell: pwsh