feat(desktop): sign Windows builds through Azure Key Vault

[davidmckayv]

OpenBot’s Windows builds lacked a publisher signature. Add a protected GitHub workflow that uses the existing DigiCert certificate in Azure Key Vault to sign the app and NSIS installer. GitHub OIDC supplies authentication without an Azure password or exported private key.

A maintainer explicitly requests signing with the windows-signing label on a same-repository PR, or through manual dispatch after merge. Ordinary and fork PR builds remain unsigned. The workflow extracts the packaged app from NSIS and verifies both that payload and the installer before uploading them; Tauri restores the unsigned build executable after bundling, so checking that intermediate file would be incorrect. No release is published.

Azure federation and GitHub environment configuration are complete. Operator instructions document the setup and signing requests.

Validation:

• Real Windows signing run passed on commit 52167c0fa38c1fc05374c3daa681da51c31136fb. Both the packaged app and installer have valid, timestamped Tawkit, Inc. signatures; SignTool reports zero warnings and errors.
• Signed Windows artifacts and signature evidence are retained for 14 days. Downloaded app/installer SHA-256 hashes match the evidence.
• All 24 signing regressions pass locally and on Windows, including the unsigned-intermediate regression. All 20 applicable PR checks are green, including the standard desktop matrix and zizmor.

Closes FOR-304

[linear-code]

FOR-304