updated Windows code-signing using Signpath

[jay-418]

background

After being gaslit by Microsoft a couple of times, we switched to the more expensive Signpath for signing, and their subcontracted GlobalSign EV certificate.

• https://github.com/getlantern/engineering/issues/2940

important info

• Signpath account is in 1password, username admin@lantern.io, approved identity: @jay-418
• build-windows.yml has an input, use-self-signed-cert, which can switch between the self-signed and the signed EV certificate which required an extensively verified identity

deliverables

• setup CI for test project
• submit application to https://signpath.org/apply
• [-] meet terms terms https://signpath.org/terms (not for an org of our maturity)
• complete EV certificate and attach to prod-policy, verify it works before merge

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jay-418]

Potentially related (but may have been latent for a while):

• https://github.com/getlantern/engineering/issues/3043

[Crosse]

@jay-418, the PowerShell looks fine. The main points I want to make are:

• don't use exit in a script
• Write-Error will stop the script completely since with $ErrorActionPreference set to Stop

The rest are cosmetic or edge-case-y.

👍