Build signed MSIX installer for fallout-agent

Parent: #121

Produce a signed MSIX (or MSI — decision documented in the issue) installer for `fallout-agent` as part of the release pipeline. The signed artifact is what the winget manifest (__W1__) points at.

## Definition of done

- Release workflow produces a single signed installer (`.msix` or `.msi`) per stable tag.
- Authenticode signing cert + password sourced from repo secrets (names documented in the workflow file).
- `signtool verify /pa` succeeds on the produced installer.
- Installer is uploaded as a GitHub Release asset with a stable URL pattern the winget manifest can template against.
- Decision recorded in the issue: MSIX (modern, restricted) vs MSI (more permissive, can run arbitrary post-install actions for service registration — see __W3__).