v0.9.0
Optional-authenticode-signing-in-release Sign BuffBar.exe (before packaging) and the Inno installer in release.yml, gated on SIGNING_PFX_BASE64 / SIGNING_PFX_PASSWORD secrets — skipped when absent, so unsigned releases still build. Add Docs/Engineering/code-signing.md covering certificate options (self-signed test, OV, Azure Trusted Signing), secret setup, and verification. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>