Add trusted Authenticode signing for Windows installer

[RolandUI]

Goal

Publish future AvaScope Windows installers with a publicly trusted Authenticode signature so Windows can verify the publisher and installer integrity.

Current state

• v1.1.3 publishes an unsigned AvaScopeSetup.exe; release-manifest.json records signatureStatus: notsigned.
• eng/package-installers.ps1 already supports an optional WindowsSignToolPath plus arguments and validates the resulting setup signature.
• The guarded GitHub Release workflow does not currently configure a signing provider.
• The final setup EXE can be signed, but the Inno Setup uninstaller is not currently signed through Inno's SignTool / SignedUninstaller integration.

Preferred provider

Use the SignPath Foundation open-source signing program after the repository is public, unless a different publicly trusted provider is explicitly selected. Do not use a self-signed certificate for public releases.

Scope

• Apply to or complete onboarding with the selected publicly trusted signing provider.
• Define the signing identity/publisher name and record the provider, certificate ownership, renewal, and revocation model.
• Integrate signing into the guarded GitHub-hosted release workflow without storing a private key or PFX in the repository.
• Sign AvaScopeSetup.exe with SHA-256 and a trusted RFC 3161 timestamp.
• Integrate Inno Setup SignTool and SignedUninstaller=yes, or implement an equivalent validated path, so the installed uninstaller is also signed.
• Decide which AvaScope-owned Windows payload executables also require Authenticode signing and implement the selected coverage before installer assembly.
• Verify the signature chain, expected publisher, timestamp, and Authenticode policy before publication.
• Regenerate release-manifest.json only after signing because signatures change artifact bytes, hashes, and sizes.
• Make the production release workflow fail closed if a required Windows artifact is unsigned, invalid, has the wrong publisher, or lacks the expected timestamp.
• Keep local/dry-run packaging possible without production credentials while clearly recording notsigned status.
• Ensure fork pull requests and untrusted workflows cannot access signing credentials or submit release-signing requests.
• Document the signing status, provider, verification command, and SmartScreen reputation expectations.

Acceptance criteria

• A future GitHub Release publishes an Authenticode-signed AvaScopeSetup.exe from the exact guarded release commit.
• Windows reports a valid trusted publisher signature and an RFC 3161 timestamp.
• The installed Inno Setup uninstaller also has a valid signature.
• The release manifest contains the post-signing SHA-256 digest, size, runtime identifier, and valid signature status.
• Automated tests reject missing, invalid, unexpected-publisher, or untimestamped production signatures.
• Signing keys are never committed or exposed to fork workflows.

External dependency

SignPath Foundation approval, or credentials/account access for the explicitly selected alternative provider, must be completed by the maintainer before production signing can be validated.

Out of scope

• Replacing or mutating the already published v1.1.3 assets.
• Self-signed certificates for public distribution.
• macOS signing/notarization.
• Linux package signing beyond the existing SHA-256 release manifest.