build: add signed release pipeline

[kev1n77]

Summary

• add a protected, fail-closed Windows/macOS signed release workflow
• sign and verify sidecar artifacts before embedding them in Tauri bundles
• require Windows Authenticode, macOS notarization/stapling, and Tauri updater signatures
• generate and re-verify latest.json plus release-manifest.v0.1.json from platform artifacts
• enforce release workflow invariants in the repository supply-chain policy
• add concise release and rollback operations documentation
• fix root desktop:tauri argument forwarding

Verification

• python -m py_compile scripts/prepare_release.py
• python scripts/prepare_release.py check-version --repository-root . --tag v0.1.0
• python -m unittest discover -s scripts/tests -v
• python scripts/verify_supply_chain.py
• actionlint .github/workflows/ci.yml .github/workflows/release.yml
• npm run desktop:check
• npm run desktop:build
• npm run desktop:tauri -- build --help
• git diff --check

Operational boundary

The workflow is intentionally not runnable without the protected release environment secrets documented in docs/release.html. Actual signed artifacts and the device rollback rehearsal remain release-owner evidence.