Implement Windows Authenticode signing in the release workflow

[eimexdev]

Part of OpenBeat v0.1.0 public launch map.

Question

What CI and packaging changes implement the Windows Authenticode strategy selected by the signing research?

Goal

Authenticode-sign the Windows installer and any executable that should carry its own signature.

Work

• Integrate the selected signing provider with GitHub Actions using least-privilege credentials.
• Sign the bundled runtime as appropriate before packaging.
• Sign and timestamp the final installer.
• Add CI verification that fails on a missing, invalid, or untrusted signature.
• Document renewal, rotation, and incident-recovery procedures.
• Test the downloaded artifact on a clean Windows system.

Acceptance criteria

Windows signature verification succeeds for the downloaded release artifact and the documented signing process is repeatable.