v1.2.0 — Printer files bring their driver's publisher trust with them

v1.2.0 — Printer files bring their driver's publisher trust with them

apply now installs a copied driver on a clean PC without a manual
certificate step. A .ssb copied from a working PC could carry a correctly
signed driver and still fail on the next machine with "The publisher of an
Authenticode(tm) signed catalog has not yet been established as trusted."
The catalog's signature was valid; Windows had simply never been told to trust
that publisher for driver installs. The fix was to export the signer
certificate and import it into Trusted Publishers by hand, which defeated the
point of a portable printer file.

Now SpoolSmith does that step itself:

• Only when Windows says the catalog is valid. SpoolSmith reads the catalog
  files the driver's INF names, asks Windows to check each signature, and takes
  the signer certificate only from a catalog Windows reports as Valid.
  Nothing in the bundle — no manifest field, no bundled .cer, no name — is
  ever trusted.
• Exactly that certificate. It is matched by thumbprint in
  LocalMachine\TrustedPublisher, so a different certificate with the same
  publisher name doesn't count. It is added straight to the store (no temporary
  .cer on disk) and checked again before the driver is staged. If it is
  already there, nothing changes: Driver publisher already trusted.
• In the plan you confirm. The install plan has a new Driver publisher
  trust line, and --dry-run --json a publisher_trust field. It states the
  rule, not whether this particular PC already trusts the publisher, so one
  reviewed --plan-hash still covers a whole fleet.
• Never the Root store. A self-signed or privately rooted catalog is never
  made to validate.

Clearer driver failures. When Windows refuses a driver package, the error now
says why — untrusted publisher, signature that doesn't validate, wrong
architecture, malformed INF, or registration failing after staging — and
includes Windows' own pnputil output instead of just "staging failed". A
pnputil result of reboot required (3010) is now treated as success.

Notes

• SpoolSmith no longer rejects an unsigned or non-validating catalog on its
  own. It says so, trusts nothing from it, and lets Windows decide when the
  package is staged. On 64-bit Windows that normally still means an unsigned
  driver is refused — by Windows, with its reason shown. A catalog whose
  signature doesn't match its own contents (evidence of modification) still
  stops the install before anything is staged.
• Only catalogs the driver's INF names are considered; other .cat files in a
  payload are ignored. If the INF names several, each valid signer is trusted.
• A printer file can therefore cause its driver's publisher to become trusted on
  the PC you apply it to. That was always the manual fix; it is now shown in the
  plan and printed during apply (signer name and thumbprint). Treat a printer
  file as trusted exactly as much as the PC it came from.
• The .ssb format is unchanged (still version 1). Plan fingerprints from
  v1.1.0 don't match v1.2.0 plans for printer files with drivers: the staging
  command changed. Take a new --dry-run fingerprint after upgrading.
• The desktop app uses the same apply path and shows the same plan; no screens
  changed.