[Feature] Apply for SignPath code signing to remove the Windows install warning

[Zaldaryon]

Problem

The Windows installer and Optimum.exe ship unsigned, so Windows SmartScreen shows an "unknown publisher" warning on the first install and first launch. Users read that as a broken or unsafe package even when the build is clean. The macOS .dmg has a similar unsigned status, but this issue is scoped to the Windows package.

Proposed change

Apply to the SignPath Foundation (https://signpath.org/apply) for a free open-source code signing certificate, then wire the Windows packaging (scripts/package.ps1 and the Inno installer output) to sign Optimum.exe and the installer through SignPath.io. SignPath issues the certificate to the project rather than to an individual, stores the private key on an HSM, and signs binaries it verifies as built from this repository, so the signed artifact carries a reproducible link back to the source.

Alternatives considered

• Pay a commercial certificate authority for an Authenticode certificate: costs money, binds the certificate to an individual identity, and does not establish the built-from-source link.
• Keep shipping unsigned and document the SmartScreen workaround: this is the current state and it keeps costing users trust on every release.
• Apple notarization for macOS: a separate problem, out of scope here.

Scope

• This does not change gameplay, balance, or add content.