Build signed MSIX installer for fallout-agent

[ChrisonSimtian]

Parent: #121

Produce a signed MSIX (or MSI — decision documented in the issue) installer for fallout-agent as part of the release pipeline. The signed artifact is what the winget manifest (W1) points at.

Definition of done

• Release workflow produces a single signed installer (.msix or .msi) per stable tag.
• Authenticode signing cert + password sourced from repo secrets (names documented in the workflow file).
• signtool verify /pa succeeds on the produced installer.
• Installer is uploaded as a GitHub Release asset with a stable URL pattern the winget manifest can template against.
• Decision recorded in the issue: MSIX (modern, restricted) vs MSI (more permissive, can run arbitrary post-install actions for service registration — see W3).