#186 Windows: Authenticode-sign the installer and portable exe

[Anonymous]

Originally created by: kristofferR

Both Windows artifacts ship unsigned today (verified: only minisign updater signatures and Apple secrets exist in CI) → SmartScreen "unknown publisher" warnings. Signing also de-facto gates a smooth winget submission (Ref [#124]).

Provider decision (gates everything, longest lead time — do first):

	SignPath OSS	Azure Trusted Signing	OV cert + token
Cost	Free (OSS program, approval needed)	~$10/mo	~$200–400/yr
Cert subject	"SignPath Foundation"	Maintainer's legal name (public in file Properties → Digital Signatures)	Legal name
CI fit	Good (synchronous PowerShell submit)	Excellent	Poor (hardware token)
SmartScreen	Established foundation cert	Fastest reputation	Slow

Recommendation: SignPath OSS primary. This repo deliberately publishes under "kristofferR" with no personal details in packaging metadata; Authenticode with a personal cert permanently exposes the legal name to every user — SignPath (cert subject: SignPath Foundation, project attribution) is the only option avoiding that. Azure Trusted Signing is the fallback: lower CI friction and fastest reputation, but requires (a) an informed OK on permanent public legal-name exposure and (b) verifying that individual identity validation is currently open for signup. Constraints either way: SignPath wants tag-builds-only + README attribution; SmartScreen reputation still accrues over the first releases even signed.

Mechanics (provider-agnostic):

• bundle > windows > signCommand (key verified in the config schema) added to tauri.conf.release.json (CI-only config — local builds unaffected), invoking scripts/sign-windows.ps1 %1. Tauri runs it for every produced binary during bundling — app exe (before NSIS packs it), setup exe, updater artifact — on both x64 and arm64 (Authenticode is arch-agnostic).
• The script: secrets absent → fail on tag refs, skip otherwise (the exact idiom of the existing DMG-notarization guard); otherwise sign with a timestamp (mandatory — short-lived certs; timestamped signatures outlive them) and verify before returning.
• Portable zip: stages the same in-place-signed exe; add a Get-AuthenticodeSignature guard that hard-fails a tagged build if the staged Chatpane.exe isn't validly signed (also settles whether the bundler signs in place on the first CI run).
• New repo secrets (SignPath: API token + non-secret slugs; Azure: tenant/client/secret + endpoint/account/profile). No secret values or names may embed personal info. All release.yml changes confined to the existing build job env + the zip guard — no new jobs.

Verification: tagged dry-run → both setup exes and portable exes show valid timestamped signatures; installer runs without the red banner; auto-update from a previous version still validates (minisign unaffected); workflow_dispatch without secrets skips signing; tagged run without secrets fails.

Part of [#187].