release: v4.3.0 - fix Windows SmartScreen blocking, add signing support

- Remove signAndEditExecutable:false so code signing works properly
- Add legalTrademarks and copyright metadata to build config
- Add publisherName via build.copyright (embedded in PE resources)
- Create scripts/create-selfsigned-cert.ps1 for local dev signing
- Update release.yml: build on windows-latest runner (not Wine),
  auto-sign when CSC_LINK_BASE64/CSC_KEY_PASSWORD secrets present,
  fall back to unsigned otherwise
- Add lint step to ci.yml (Phase 4.3 plan gap)
- Add .vscode/launch.json debug configs (Phase 4.3 plan gap)
- Fix .gitignore: exclude *.pfx/*.p12 cert files, track launch.json,
  fix concatenated agents.md/coverage/ lines

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.gitignore

@@ -8,7 +8,8 @@ Thumbs.db
 *.swp
 *.swo
 *~
-.vscode/
+.vscode/*
+!.vscode/launch.json
 .idea/
 *.iml
 out/
@@ -17,6 +18,10 @@ out/
 .electron/
 package-lock.json
 
+# Code signing certificates — never commit private keys
+*.pfx
+*.p12
+
 # Screenshots and temp files
 *.png.bak
 Screen.png
@@ -33,4 +38,5 @@ pdf\ modal.png
 # Claude/AI development files
 .claude/
 CLAUDE.md
-agents.mdcoverage/
+agents.md
+coverage/