See the GitHub release notes for changes since the previous tag.
macOS bundles are Developer ID-signed and notarized; the in-app
updater is fed from this release's own latest.json asset. Windows
bundles are Authenticode-signed via Azure Trusted Signing when the
AZURE_* repo variables are configured.