Order the Windows signing jobs instead of grouping them

[FrodeHus]

Fixes a regression I introduced in #199.

What went wrong

Only one job per concurrency group may be pending. When a newer job wants the group, the one already waiting is cancelled. cancel-in-progress: false governs the running job, not the queue. (The "up to 100 pending" in the docs describes queue: max, which is a different setting.)

cli and audit are matrix jobs, so putting one group on them enrolled every leg. In the v1.8.0 run, CLI (linux) and CLI (windows) were cancelled the second they started:

CLI (linux):   cancelled  12:55:50 -> 12:55:50
CLI (windows): cancelled  12:55:50 -> 12:55:50
CLI (macos):   success    13:02:45 -> 13:05:58   (the last one queued, so it survived)
Windows app:   failure    12:55:53 -> 13:02:36

I had raised this hazard when proposing the fix and then talked myself out of it on a docs answer that was about a different setting. That was the error.

What this does instead

• The group now covers only non-matrix signing jobs — the Windows app and the manual signing check — where at most one can ever be pending, so nothing is cancelled.
• The actual race (Windows app vs the CLI's windows leg, same single-use TOTP) becomes ordering: cli lists windows in needs, guarded with always() && needs.check.result == 'success' so a failed Windows app still lets the CLI build and sign instead of skipping it.
• The cost is that the linux and macOS legs start after the app job — which the group was charging them anyway, only by cancelling them.

Verification

YAML parses and the three jobs carry what they should. Not proven against a real release, and deliberately so: each attempt is a Certum login, and the account locks on repeated failure. See the note below before the next attempt.

Unrelated: the v1.8.0 signing attempt failed differently

The run after the re-tag failed at a new place — Certificate *** did not appear in Cert:\CurrentUser\My within 180 seconds, i.e. no rejection modal at all, the certificate simply never arrived. That is not the TOTP race and not this change. Given how many logins that account saw today, I would not spend another one before someone checks the account's standing in SimplySign.

Co-authored-by: Claude Opus 5 noreply@anthropic.com