Sign Windows releases with SignPath

[nwparker]

Summary

• route Windows release artifacts through SignPath before publishing
• upload unsigned installer as a GitHub Actions artifact and submit it for signing
• hardcode the stable SignPath organization/project/test policy identifiers; keep only SIGNPATH_API_TOKEN as a secret
• regenerate updater blockmap and latest.yml metadata for the signed installer

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); puts "release.yml parses"'\n- git diff --check\n\nNote: actionlint was attempted locally, but the npm package had no binary and the Go install requires a newer Go version than this machine has.

Note

Waiting for production certificate

Fixes #587