Cut over Windows releases to the Microsoft Store

## Problem

The repository and release documentation still describe an unsigned Windows executable, GitHub Release distribution, and SignPath signing. Leaving those paths in place after Store publication would give users conflicting and potentially untrusted installation choices.

## Proposed change

Make the Microsoft Store the documented public Windows distribution path after a manual acquisition check on an externally available Windows 11 device. Remove the unsigned Windows executable from public stable and rolling-development release assets while retaining private GitHub Actions artifacts needed for CI diagnostics. Replace obsolete SignPath and direct-download guidance. Preserve macOS GitHub Release artifacts, PyPI publishing, and Homebrew publishing.

## Acceptance Criteria

- [ ] AC1: Before a distinct later tagged version is submitted, a manual check on an externally available Windows 11 device acquires the current Store version. After the protected workflow submits that later version and Partner Center reports it **In the Store**, the same device receives the update, launches the representative workflow, and uninstalls the app; the result and GitHub-runner limitation are recorded.
- [ ] AC2: Windows installation guidance links to the published Microsoft Store listing and does not require users or maintainers to build the application locally.
- [ ] AC3: Operator documentation covers the one-time Partner Center setup, manual first publication, automated tagged updates, asynchronous certification, credential rotation, and failure recovery.
- [ ] AC4: Stable GitHub Releases omit Windows EXE and MSIX binaries while retaining the existing macOS, PyPI, and Homebrew release behavior.
- [ ] AC5: The rolling development prerelease no longer publishes an unsigned Windows executable, while the Windows build remains available as a non-public GitHub Actions artifact for validation and diagnosis.
- [ ] AC6: SignPath, direct Windows installer signing, and contradictory unsigned-download claims are removed from current documentation and workflows.
- [ ] AC7: The changelog records Microsoft Store distribution and the removal of public unsigned Windows release assets.

## Dependencies

Blocked by **Automate Microsoft Store updates from tagged releases**.

## Implementation classification

- **Estimated size:** M
- **Orchestration risk:** Normal
- **Reason:** This is a bounded release-channel and documentation cutover across the existing native workflows and user/operator guidance.