docs: SignPath declined for now — record both remaining routes honestly

[zcsizmadia]

The SignPath Foundation's free OSS programme declined the application — it is for projects with an established user base, and Skrog does not have one yet. They invited a reapplication as visibility grows.

Five documents claimed signing was applied for and imminent, and docs/code-signing.md credited SignPath as though they were already sponsoring us. All of that is now false, and it is the kind of false that matters: someone deciding whether to trust an unsigned binary should not be told a signature is on its way when nobody has promised one.

The honest position: two routes, neither closed

free	the Foundation, deferred until the project is bigger — and gated on exactly the thing signing would help with, since winget builds reputation fastest and wants a signed installer
paid	a subscription, which needs nobody's approval and could happen at any time

What docs/code-signing.md keeps, and what it drops

Keeps the roles, the CI-only signing rule and the threat model. They were written to meet the Foundation's requirements, but they are good practice whoever issues a certificate, and having them settled beats inventing them in a hurry the week a certificate arrives.

Drops the attribution block crediting SignPath for providing free signing. They are not sponsoring this project; leaving it would be misleading.

Adds the part that is actually the decision in #77, because the cheaper option is not automatically the better one:

The Foundation issues the certificate to the project and forbids commercial dual-licensing of any component, and can pause or revoke. A purchased certificate costs money but nobody can withdraw it over a licence change.

So the free route keeps a door open that the paid route closes — and vice versa.

Elsewhere

• ROADMAP — signing lifted out of the weekend plan. It is a decision, not a scheduled item, so a date next to it was fiction.
• PLAN — the SmartScreen risk is raised to high, with the circularity stated rather than assumed away: the free route is gated on adoption, winget would drive adoption, winget wants a signed installer.
• README, install guide, RELEASING — no promised date; both routes named; #77 is where the choice lives.

Docs only, no behaviour change. The thing every release does carry — SLSA provenance and a cosign-signed SHA256SUMS — is unchanged and still stated as not a substitute for signing.