release: v4.3.0 - fix Windows SmartScreen blocking, add signing support

- Remove signAndEditExecutable:false so code signing works properly
- Add legalTrademarks and copyright metadata to build config
- Add publisherName via build.copyright (embedded in PE resources)
- Create scripts/create-selfsigned-cert.ps1 for local dev signing
- Update release.yml: build on windows-latest runner (not Wine),
  auto-sign when CSC_LINK_BASE64/CSC_KEY_PASSWORD secrets present,
  fall back to unsigned otherwise
- Add lint step to ci.yml (Phase 4.3 plan gap)
- Add .vscode/launch.json debug configs (Phase 4.3 plan gap)
- Fix .gitignore: exclude *.pfx/*.p12 cert files, track launch.json,
  fix concatenated agents.md/coverage/ lines

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/release.yml

@@ -43,7 +43,7 @@ jobs:
           retention-days: 5
 
   build-windows:
-    runs-on: ubuntu-latest
+    runs-on: windows-latest
     steps:
       - uses: actions/checkout@v4
 
@@ -53,17 +53,32 @@ jobs:
           node-version: 20
           cache: npm
 
-      - name: Install Wine and NSIS
-        run: |
-          sudo dpkg --add-architecture i386
-          sudo apt-get update
-          sudo apt-get install -y wine64 wine32 nsis
-
       - name: Install dependencies
         run: npm ci
 
-      - name: Build Windows packages
-        run: npm run build:win
+      - name: Run tests
+        run: npm test
+
+      - name: Decode certificate (if available)
+        if: ${{ secrets.CSC_LINK_BASE64 != '' }}
+        shell: pwsh
+        run: |
+          $bytes = [Convert]::FromBase64String("${{ secrets.CSC_LINK_BASE64 }}")
+          [IO.File]::WriteAllBytes("${{ github.workspace }}\code-signing-cert.pfx", $bytes)
+          echo "CERT_AVAILABLE=true" >> $env:GITHUB_ENV
+
+      - name: Build Windows packages (signed)
+        if: ${{ env.CERT_AVAILABLE == 'true' }}
+        env:
+          CSC_LINK: code-signing-cert.pfx
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+        run: npm run build:win-signed
+
+      - name: Build Windows packages (unsigned)
+        if: ${{ env.CERT_AVAILABLE != 'true' }}
+        env:
+          CSC_IDENTITY_AUTO_DISCOVERY: false
+        run: npm run build:win-unsigned
 
       - name: Upload Windows artifacts
         uses: actions/upload-artifact@v4
@@ -72,6 +87,7 @@ jobs:
           path: |
             dist/*.exe
             dist/*-win.zip
+            dist/*.zip
           retention-days: 5
 
   release: