ci(signpath): integrate production Windows signing

[ewen-poch]

Problem

The Windows release build currently emits an unsigned NSIS setup executable. The manual SignPath
test workflow proves that SignPath can sign the outer installer, but stable Release jobs do not yet
finalize the installer through the production policy. Signing also changes installer bytes, which
invalidates electron-builder's original latest.yml hash/size and blockmap.

Proposed change

• Add one reusable SignPath finalizer for both test and production policies.
• Submit only the final NSIS setup EXE, verify the returned Authenticode signer, and replace the
  complete Windows build artifact before package smoke.
• Regenerate the Windows blockmap and latest.yml SHA-512/size from the signed installer.
• Require the configured production publisher Subject during stable package smoke and require
  signed-Windows certification evidence before publication.
• Bake SIGNPATH_WINDOWS_PUBLISHER_NAME into the packaged updater configuration through
  electron-builder's win.signtoolOptions.publisherName option.
• Delete the temporary unsigned SignPath input artifact so the Release's merged artifact download
  cannot collide with or publish unsigned bytes.
• Reuse the same path from signpath-test.yml with the Foundation self-signed test certificate.

Scope and non-goals

• Phase 1 signs only *-win-x64-setup.exe.
• Pinned third-party micromamba.exe and micromamba-compat.exe remain unchanged and retain their
  existing archive/binary digest verification.
• The first-party unpacked application executable is not deep-signed in this phase.
• This PR does not create a Release or exercise the production certificate.

Acceptance criteria and validation

Final evidence after the last material edit:

• Reusable SignPath/release/smoke workflow contracts ->
  vitest run scripts/windows-release-workflows.test.ts -> passed.
• Signed-installer blockmap and feed regeneration ->
  vitest run scripts/refresh-windows-release-metadata.test.ts -> passed.
• Signed Windows release-evidence gate ->
  vitest run scripts/ci/release-certification-evidence.test.ts -> passed.
• Existing electron-builder Windows configuration contract ->
  vitest run scripts/electron-builder-config.test.ts -> passed.
• Combined focused suite -> 25 tests passed.
• Dependency/lockfile installation contract ->
  npm ci --dry-run --ignore-scripts --omit=optional --no-audit --no-fund -> passed (existing peer
  warnings only).
• Changed-file formatting -> Prettier check passed.
• GitHub Actions syntax -> actionlint passed with only two pre-existing shellcheck warnings in
  unchanged build.yml script lines.
• Patch hygiene -> git diff --check origin/main...HEAD passed.
• Independent Standards review -> passed after declaring exact app-builder-lib@26.15.3.
• Independent Spec review -> passed after adding always-run cleanup for the unsigned input artifact.

Per maintainer direction, the full local npm test suite was not run; exact-head PR CI is the
authority for the complete portable and platform lanes.

Review focus

• Stable tag dependency order: build -> SignPath finalizer -> package smoke -> publish.
• Exact production certificate Subject configured in SIGNPATH_WINDOWS_PUBLISHER_NAME.
• Fail-closed behavior when the production policy, signature trust, signer Subject, metadata refresh,
  or temporary-artifact cleanup fails.
• Electron-updater compatibility of the regenerated latest.yml and gzip blockmap.

Uncovered risks

• The release-signing policy and production certificate are not exercised by this PR. They must be
  active in SignPath before the next tag.
• SIGNPATH_WINDOWS_PUBLISHER_NAME must exactly match the production certificate Subject.
• A no-publish branch dry-run with test-signing will be attached after the PR is opened.

[github-actions]

Codex Review

Verdict: needs changes

[P1] Bake the publisher into updater metadata

.github/workflows/build.yml:310

Impact: Stable builds can produce Authenticode-valid installers whose app-update.yml omits publisherName, so auto-updates skip publisher verification.

Recommendation: Use the platform-level win.publisherName override and add a check that generated updater metadata contains it.

Summary: The Windows build passes the publisher through electron-builder’s signing-tool options, but updater verification reads the platform-level publisher setting.

[ewen-poch]

SignPath no-publish dry-run passed end to end: https://github.com/aipoch/open-science/actions/runs/32228509136

Verified in the run:

• submitted the NSIS setup EXE through the test-signing policy
• verified the returned test-certificate Authenticode signature
• replaced the installer and regenerated .blockmap / latest.yml
• uploaded the complete finalized Windows artifact
• deleted the temporary unsigned artifact

The first Windows E2E attempt hit an unrelated Windows temp-file EPERM rename failure. The failed jobs were rerun and the full PR gate passed.