Complete Windows signing provider onboarding

[eimexdev]

Part of OpenBeat v0.1.0 public launch map.

Question

Complete the external Windows signing-provider onboarding required before the release workflow can be implemented.

• If the pending SignPath Foundation application is approved, configure OpenBeat’s project, signing policy, and GitHub Actions integration prerequisites.
• If SignPath is declined or unavailable by the launch deadline, provision Azure Artifact Signing Public Trust Basic for the release month with narrowly scoped GitHub OIDC access.
• Record the selected provider, non-secret resource identifiers, access/approval requirements, and any provider-specific constraints needed by Implement Windows Authenticode signing in the release workflow.

Do not place signing credentials or private identifiers in the issue.