Sign Windows release binaries via SignPath

[akenshaw]

This PR hardens the release pipeline: Windows binaries are now signed with a CA-issued certificate through SignPath, release re-runs are idempotent, and a new guard prevents releasing a tag that doesn't match the crate version.

Code signing

• Windows builds are submitted to SignPath after the build and repackaged once the signed binaries come back
• README now acknowledges SignPath for providing this free code signing

Idempotent re-runs

• Re-running the workflow with an existing tag updates that release instead of failing when the tag isn't at HEAD
• The tag is the source of truth: the build checks out the tag and re-uploads assets into the same draft release
• SHA256SUMS and its GPG signature are regenerated and attached on every run

Version guard

• The workflow refuses to package if the tag doesn't match the version in Cargo.toml at the tagged commit (accepts v-prefixed tags)

Pipeline modernization

• Replaced deprecated create-release / upload-release-asset / actions-rs/toolchain with softprops/action-gh-release and dtolnay/rust-toolchain
• Windows artifacts now repackaged with Compress-Archive and unpacked for signing
• Bumped checkout/upload/download actions to v7/v8 and added the actions: read permission