docs: track releases README while keeping binaries local-only

.gitignore

@@ -29,6 +29,7 @@ signup_draft.json
 proxy_chain_manager/_bundled/
 
 # Release output (scripts/release_build.ps1) — upload as CI artifacts / GitHub Release
-releases/
+releases/*
+!releases/README.md
 build/version_info.txt
 

releases/README.md

@@ -0,0 +1,25 @@
+# Proxy God — Windows releases
+
+Production builds live here after running `build_release.bat` from the repo root.
+
+## Latest: v1.0.0
+
+| File | Description |
+|------|-------------|
+| `v1.0.0/ProxyChainManager.exe` | Main application (UAC admin, one-file PyInstaller build) |
+| `v1.0.0/ProxyChainManager.exe.sha256` | SHA256 checksum |
+| `v1.0.0/RELEASE_MANIFEST.json` | Version, git commit, build time, platform |
+| `v1.0.0/SBOM.json` | Frozen dependency list at build time |
+| `v1.0.0/requirements-frozen.txt` | Same as SBOM, pip freeze format |
+| `v1.0.0/LICENSE` | MIT |
+| `v1.0.0/OPERATOR_RUNBOOK.md` | Emergency ops (firewall disengage, etc.) |
+| `ProxyGod-v1.0.0-windows-amd64.zip` | Full release archive |
+
+### Verify download
+
+```powershell
+Get-FileHash -Algorithm SHA256 releases\v1.0.0\ProxyChainManager.exe
+Get-Content releases\v1.0.0\ProxyChainManager.exe.sha256
+```
+
+Build commit: see `RELEASE_MANIFEST.json` inside the folder.