feat: show signed release changelog in update history

scripts/test-update-fixture.sh

@@ -315,6 +315,10 @@ download_and_prepare_install() {
   [ "$(jq -r '.requestId' "$fixture/state/status.json")" = 01M00000000000000000000091 ] \
     && [ "$(jq -r '.action' "$fixture/state/status.json")" = DOWNLOAD ] \
     || fail 'download phase did not preserve request correlation'
+  [ "$(jq -r '.releaseNotes' "$fixture/state/status.json")" = fixture ] \
+    || fail 'download phase did not persist the signed release notes'
+  [ "$(jq -r '.publishedAt' "$fixture/state/status.json")" = 2026-08-16T00:00:00Z ] \
+    || fail 'download phase did not persist the signed release publish time'
   [ "$(readlink "$fixture/app/current")" = "$fixture/app/releases/1.0.0-preview.1" ] \
     || fail 'download phase changed the active application'
   [ -s "$fixture/state/cache/$version/release.tar.gz" ] \
@@ -456,6 +460,8 @@ assert_success_case() {
   [ "$(jq -r '.requestId' "$fixture/state/status.json")" = 01M00000000000000000000092 ] \
     && [ "$(jq -r '.action' "$fixture/state/status.json")" = INSTALL ] \
     || fail 'success case did not preserve install request correlation'
+  [ "$(jq -r '.releaseNotes' "$fixture/state/status.json")" = fixture ] \
+    || fail 'success case did not retain the signed release notes'
   [ ! -e "$fixture/state/processing/request.json" ] \
     || fail 'success case left a claimed request behind'
   grep -qx 'daemon-reload' "$fixture/systemctl.log" || fail 'systemd units were not reloaded'