Add SignPath code signing workflow

[Hirogen]

Summary

Adds a manually started workflow that signs LogExpert through SignPath (SignPath Foundation, free signing for open source), starting with the test certificate.

• .github/workflows/signpath_sign.yml: builds Release, uploads bin/Release, has SignPath sign our own binaries, packages the signed files with Nuke (Pack with Restore Compile Test skipped), then signs the installer in a second request. A dropdown chooses test-signing or release-signing.
• src/docs/CODE_SIGNING.md: how it works, what is and isn't signed, the SignPath and GitHub setup, the artifact configuration XML, and the Foundation's conditions for the release certificate.

Not signed, on purpose

• Built-in plugins: PluginValidator checks them against SHA256 hashes taken at compile time. Signing changes the bytes, so every built-in plugin would fail verification in Release. This needs a separate change that hashes after signing.
• Third-party DLLs: the Foundation only signs binaries built from our own source.
• unins000.exe: needs SignTool set up in the Inno Setup script. Can be done later.

Before it can run

• SignPath: GitHub.com trusted build system linked to the project, test-signing policy, artifact configurations app-files and initial, CI user as Submitter
• Repo secret SIGNPATH_API_TOKEN
• Repo variables SIGNPATH_ORGANIZATION_ID and SIGNPATH_PROJECT_SLUG

Test plan

• After merge: Actions → Code Signing (SignPath) → run with test-signing
• Check binary signatures lists every signed file (status UnknownError is expected with the test certificate)
• The packaging step works with --skip Restore Compile Test (not verified locally, because Nuke's --help crashes in a local terminal)
• The installer from the signed-packages-test-signing artifact shows a signature, installs, and the built-in columnizers load