[Task] Windows code signing (Authenticode)

[shellen]

Part of: [Epic] Add Windows support (#66)

Summary

Set up Windows Authenticode code signing for the installer and executable. Without signing, Windows SmartScreen will warn users on download/install.

Options

1. Azure Trusted Signing: Cloud-based, no hardware token needed
2. Traditional Authenticode certificate: From a CA like DigiCert, Sectigo, etc.
3. Ship unsigned initially: Accept SmartScreen warnings for early adopters

Acceptance Criteria

• Decision made on signing approach
• Signing configured in CI pipeline (if applicable)
• Built installer passes SmartScreen or has acceptable UX for unsigned

Estimate: ~0.5 day