Track SignPath approval and first signed Windows release

[Lkkisme]

This issue tracks the remaining work after the SignPath Foundation application was submitted on 2026-06-21.

Public status source: https://github.com/Lkkisme/Cap/blob/main/docs/signpath-foundation-status.md

Checklist:

• Receive SignPath Foundation response.
• Complete SignPath onboarding, including SignPath MFA if required.
• Configure SignPath project, signing policy, artifact configuration, and trusted GitHub build system.
• Add required GitHub Variables and Secrets.
• Run Windows Signing Check and record the run URL.
• Publish a new cap-v* signed Windows release.
• Verify EXE/MSI signatures are Valid.
• Verify portable ZIP internal EXE/DLL signatures are Valid.
• Attach release audit, installer smoke test, WinGet, WDSI, checksum, and attestation evidence.