feat(release): sign Windows installer via Azure Trusted Signing

[huntharo]

Recreates #674, which GitHub auto-closed when main's history was rewritten. Same change, rebased onto current main.

What & why

Adds optional Authenticode signing for the Windows NSIS installer using
Azure Trusted Signing (electron-builder 26's native cloud-signing support) —
no hardware token, GitHub-hosted-runner friendly, removes the SmartScreen
"unknown publisher" warning. Follow-up to the Windows port (#670), which shipped
the installer unsigned.

Signed-when-configured, unsigned-otherwise — degrades gracefully so local,
sandbox, and label-gated PR builds keep working with no secrets.

Changes

• release.mjs: resolveWindowsAzureSigning() reads WIN_AZURE_SIGN_* (config)
  • AZURE_TENANT_ID/CLIENT_ID/CLIENT_SECRET (service-principal creds, read by
    electron-builder's bundled TrustedSigning module). When all present, injects
    --config.win.azureSignOptions.{publisherName,endpoint,codeSigningAccountName,certificateProfileName}
    into the --win electron-builder invocation; otherwise builds unsigned
    with a clear warning.
• release.mjs: runChecked uses a shell only for pnpm on Windows (the .cmd
  shim), not node — so the publisherName=PwrDrvr LLC override (which has a
  space) isn't word-split by shell:true.
• release.yml (windows-package, release tags only): passes the signing config
  from repo variables and creds from repo secrets; empty → unsigned.
• docs/desktop-windows-signing.md: setup runbook.

Activation

No behavior change until configured. Once these are set, the next release tag
produces a signed installer:

• Variables: WIN_AZURE_SIGN_PUBLISHER_NAME, WIN_AZURE_SIGN_ENDPOINT, WIN_AZURE_SIGN_ACCOUNT, WIN_AZURE_SIGN_PROFILE
• Secrets: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET

Notes

• Eligibility (your action): Azure Trusted Signing needs a paid Azure sub and
  a US/Canada org 3+ yrs (or US/Canada individual, or EU/UK org) — see runbook.
• Label-gated PR installer builds (ci:windows-package) stay unsigned by
  design (secrets aren't exposed to PR validation).
• Publishing the signed installer to the GitHub Release (today a workflow
  artifact) is a separate follow-up.

🤖 Generated with Claude Code