Sign Windows release binaries

[Widthdom]

Summary

• Authenticode-sign Windows release cdidx.exe binaries in the release workflow using WIN_SIGNING_CERT_BASE64 and WIN_SIGNING_CERT_PASSWORD secrets.
• Verify the signed executable with signtool verify before creating Windows ZIP artifacts.
• Document Windows signature verification in README and USER_GUIDE.

Validation

• dotnet run --project tools/CodeIndex.Changelog -- check
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); puts "release.yml YAML OK"'
• git diff --check
• adversarial review: No blocking/actionable issues found.

Documentation and changelog

• Updated README.md and USER_GUIDE.md with Windows Authenticode verification guidance.
• Added changelog fragment changelog.d/unreleased/1845.security.md.

Follow-up candidates

• None.

Fixes #1845