InteractiveMask v1.0.5 — MSI installer + signing pipeline

First release with a working MSI installer and an Authenticode signing flow.

Fixed (WiX 5 SDK migration)

• `DefineConstants` wrapped in a `` element no longer works in WiX 5; moved to a global ``.
• Path-style preprocessor variables get backslash-mangled by the WiX preprocessor. Hardcoded relative paths in `` and `!(bindpath.X)` for the linker-resolved ``. Named `` items now use the `BindName` metadata.
• `` moved out of `util.wixext` into a dedicated `WixToolset.Firewall.wixext` package; added the package and the `fire:` namespace.
• `x64` so harvested files in `ProgramFiles64Folder` no longer trigger ICE80.

Added (Authenticode signing)

• `tools/sign-build.ps1` — signtool wrapper for SafeNet EV-token workflows. Cert in `CurrentUser\My` is selected via `/n ""` or `/sha1 `. SHA-256 file digest + SHA-256 timestamp digest, default timestamp server is DigiCert.
• `build-installer.ps1` gains `-Sign` / `-CertSubject` / `-CertThumbprint` / `-TimestampUrl`. The flow signs every `InteractiveMask.*.exe` / `.dll` BEFORE the WiX harvest (so the embedded cab contains signed binaries) and signs the MSI itself after. Microsoft / IDIS DLLs are not re-signed.

Build the unsigned MSI

```powershell
.\build-installer.ps1 -Version 1.0.5

-> build\publish\InteractiveMask-1.0.5.msi

```

Build a signed MSI (SafeNet token plugged in + unlocked)

```powershell
.\build-installer.ps1 -Version 1.0.5 -Sign -CertSubject 'IDIS Nederland BV'
```

Upgrade

Pull, rebuild — no behaviour change for the kiosk or the WebHost.