Sign Windows releases with SignPath

[nwparker]

Summary

• route Windows release artifacts through SignPath before publishing
• upload the unsigned installer as a GitHub Actions artifact and submit it for production signing
• notify Slack via SLACK_WEBHOOK_URL with the SignPath approval link before waiting for manual approval
• hardcode stable SignPath organization/project/release policy identifiers; keep SIGNPATH_API_TOKEN and SLACK_WEBHOOK_URL as secrets
• wait for SignPath Foundation manual approval, then regenerate updater blockmap/latest.yml metadata for the signed installer

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release-cut.yml"); puts "release-cut.yml parses"'\n- git diff --check origin/main...HEAD\n\n## Release note\nProduction Windows signing now uses the SignPath release-signing policy. During an actual release, approve the signing request from the Slack link or in the SignPath UI while the Windows build job is waiting.\n\nFixes Add EV Code signing to avoid windows smartscreen warning. #587\n