feat: seed Scoop manifest + auto-update workflow

Mirror of installer/scoop/fai.json in fai/platform. Source
of truth is the platform repo; this is a passive distribution
mirror.

Auto-update workflow at .forgejo/workflows/update.yml runs
every 4 hours, diffs the latest platform release against
fai.json, and rewrites version + url + hash when a new
version ships. Manual trigger via workflow_dispatch.

Users install with:
  scoop bucket add fai \
    https://git.flemming.ai/fai/scoop-bucket
  scoop install fai

End-state matches Phase 1 of
docs/releases/go-live-checklist.md.

fai.json

@@ -0,0 +1,45 @@
+{
+    "$schema": "https://raw.githubusercontent.com/ScoopInstaller/Scoop/master/schema.json",
+    "version": "0.12.1",
+    "description": "Deterministic workflow engine for AI-assisted data processing in regulated environments.",
+    "homepage": "https://flemming.ai/",
+    "license": "Apache-2.0",
+    "architecture": {
+        "64bit": {
+            "url": "https://git.flemming.ai/fai/platform/releases/download/v0.12.1/fai-windows-x86_64.exe#/fai.exe",
+            "hash": "sha256:0000000000000000000000000000000000000000000000000000000000000000"
+        }
+    },
+    "bin": "fai.exe",
+    "post_install": [
+        "Write-Host ''",
+        "Write-Host 'F∆I installed. Bootstrap the per-user layout with:'",
+        "Write-Host '  fai bootstrap'",
+        "Write-Host 'then'",
+        "Write-Host '  fai daemon start'",
+        "Write-Host ''"
+    ],
+    "checkver": {
+        "url": "https://git.flemming.ai/fai/platform/releases.atom",
+        "regex": "<title>v([\\d.]+)</title>"
+    },
+    "autoupdate": {
+        "architecture": {
+            "64bit": {
+                "url": "https://git.flemming.ai/fai/platform/releases/download/v$version/fai-windows-x86_64.exe#/fai.exe",
+                "hash": {
+                    "url": "$url.sha256",
+                    "regex": "^([a-fA-F0-9]{64})"
+                }
+            }
+        }
+    },
+    "notes": [
+        "F∆I includes a sandboxed WASM runtime. First launch may",
+        "trigger SmartScreen because the binary is not yet",
+        "Authenticode-signed; this is tracked as the remaining",
+        "Windows half of system-gap S-16. Verify the binary",
+        "manually against its ECDSA signature sidecar:",
+        "  fai admin verify --self"
+    ]
+}