Support Certum-backed Windows release signing

[trissim]

Outcome

OpenHCS production tags now use the same protected-key model as Fiji and Jaunch: a Certum Open Source Code Signing certificate projected into the current Windows user certificate store by SimplySign or compatible hardware/cloud middleware.

Trust boundary

• Runs only on a dedicated self-hosted Windows x64 runner labeled openhcs-signing.
• Selects one exact CurrentUser/My certificate by public SHA-1 thumbprint.
• Requires an accessible non-exportable private key, current validity, and the code-signing EKU before invoking SignTool.
• Signs the existing installer with SHA-256 and the Certum RFC 3161 timestamp service.
• Requires SignTool policy verification, a native PowerShell Valid status, the exact configured signer thumbprint, and a timestamp-authority certificate before upload.
• Removes the exportable PFX, base64 secret, password secret, and hosted-runner fallback.
• Keeps local and pull-request installer builds unsigned; production tags fail closed.

Verification

• 56 installer and release-workflow tests passed.
• Ruff check and format check passed.
• Workflow YAML, runner-label, timeout, credential-boundary, and diff-hygiene gates passed.
• Strict Sphinx dummy build passed for all 149 documentation sources.

Native acceptance still required

A signed release candidate requires the real Certum certificate/session, an interactive Windows signing runner, and the public OPENHCS_WINDOWS_SIGNING_CERTIFICATE_THUMBPRINT repository variable. No public installer is claimed to be signed by this PR alone.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[augmentcode]

^{PR Risk Analyzer Agent🛡️}

👀 Human Input Needed
A pair-review briefing is ready for you.

→ Pair Review Briefing

[augmentcode]

^{Deep Code Review Agent🐛}

Review completed with 1 suggestions.

[augmentcode]

The new Windows signing path is covered here only by source-text checks, so regressions in Normalize-CertificateThumbprint, env fallback, or certificate validation behavior would still pass as long as these tokens remain in the file. That leaves the non-trivial fail-closed signing gate without a behavioral test.

Severity: medium

---

_{🤖 Was this useful? React with 👍 or 👎}