Sign the Windows release binaries (Authenticode) #1841

#185 mentioned code signing as a follow-up, but no issue tracks it. This is that issue.

Problem

On managed corporate Windows machines, application-control policies (Smart App Control, WDAC, AppLocker) and Defender's reputation checks can refuse to start an unsigned executable. mxcli-windows-*.exe is unsigned, so on such a machine mxcli may not start at all. A program that launches it sees the process creation fail; Node, for example, reports spawnSync ... UNKNOWN. Signed executables in the same folder are not affected.

For the user there is nothing to click through. The only way forward is an IT exception per file hash, and it has to be renewed for every mxcli release.

Proposal

• Sign mxcli-windows-amd64.exe and mxcli-windows-arm64.exe in release.yml:
  • use an organisation certificate, for example Azure Trusted Signing;
  • include an RFC 3161 timestamp.
• Sign before the upload, so that the release asset digests describe the signed files.
• Optional: embed a VERSIONINFO resource, for example with goversioninfo.

A signed binary lets enterprises allow the publisher once with a single rule, instead of one hash per version.