Fix Windows updater signing order

[mando]

Summary

• use Tauri’s bundle.windows.signCommand to Authenticode-sign Windows artifacts during bundling
• install artifact-signing-cli and invoke it through a checked-in PowerShell wrapper
• remove post-build installer signing and release-asset replacement that invalidated updater signatures

Configuration

• requires AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID
• uses the existing Artifact Signing endpoint, account, and profile secrets

Verification

• bun test (681 tests)
• release workflow YAML parses successfully
• Tauri configuration JSON parses successfully

Closes #290

[mando]

Follow-up fix for the latest Windows run:

The Tauri custom signer was reached, but artifact-signing-cli failed inside the PowerShell wrapper. The CLI v0.11.0 has hard-coded default paths for Azure CLI and SignTool; the hosted runner image can change those paths. The workflow now resolves both tools on the runner, exports the paths through GITHUB_ENV, and passes them explicitly to the Tauri signCommand wrapper for both Windows x64 and ARM64 builds.

Commit: dfae195e

[mando]

The next run confirmed the resolved paths are valid:

• artifact-signing-cli: C:\Users\runneradmin\.cargo\bin\artifact-signing-cli.exe
• Azure CLI: C:\Program Files\Microsoft SDKs\Azure\CLI2\wbin\az.cmd
• SignTool: Windows SDK 10.0.26100.0\x64\signtool.exe

The remaining failure is inside the signer, but Tauri only reports failed to run powershell.exe because it discards the wrapper stderr. Commit ee932503 now captures the signer output and exit code in the GitHub Actions job summary, with configured Azure values redacted.

[mando]

The completed diagnostic run still exposed only Tauri's generic failed to run powershell.exe; the job summary is not included in downloadable Actions logs/API responses.

Commit b32e584d now writes the redacted signer output to RUNNER_TEMP and prints it from an always() workflow step, so the next run will expose the actual failure in the normal log.

Diagnostic run started: https://github.com/Agent-Deployment-Co/argus/actions/runs/29765000301

[mando]

Root cause found in diagnostic run 29765000301: the always() diagnostic step reported that the signing wrapper never created its log on either Windows job. Tauri runs the custom sign command from src-tauri, so src-tauri/sign-windows-artifact.ps1 resolved incorrectly.

Commit 0adc2aa8 changes the configured script path to sign-windows-artifact.ps1, which is adjacent to the Tauri config. A verification run is in progress: https://github.com/Agent-Deployment-Co/argus/actions/runs/29769898474