Implement ClickOnce signing algorithm version 2

## Summary

Implement the [ClickOnce signing algorithm version 2 specification](https://github.com/dotnet/sign/blob/main/docs/specs/ClickOnce-Signing-Algorithm.md) through small PRs that merge serially without exposing incomplete behavior.

## Planned PRs

- [ ] **PR 1: Manifest foundation**: Add packaged MSBuild dependencies and dormant typed manifest APIs. Actual PR: #1050
- [ ] **PR 2: File graph**: Add manifest-driven dependency discovery and file classification. Actual PR: #1051
- [ ] **PR 3: Safe staging**: Add contained staging, collision checks, mapped-suffix handling, and reference rebinding. Actual PR: #1058
- [ ] **PR 4: Signing operation coordinator**: Add invocation-scoped coordination and stable signing-source identities.
- [ ] **PR 5: Signing lifecycle**: Add the shared staging, signing, copy-back, and output lifecycle without activating coordination.
- [ ] **PR 6: Coordinator integration**: Activate invocation-scoped coordination across signing formats and containers.
- [ ] **PR 7: Version 2 application manifests**: Add dormant version-2 application-manifest signing.
- [ ] **PR 8: Version 2 deployment manifests**: Add the dormant deployment-manifest pipeline and ordering behavior.
- [ ] **PR 9: CLI exposure and package validation**: Expose version 2 and prove extracted `sign.dll` uses packaged MSBuild dependencies.
- [ ] **PR 10: User documentation**: Document options, rollout, re-signing modes, examples, and operational behavior.

## Completion criteria

- The specification is fully implemented and documented.
- Every PR includes its required tests and can merge in order.
- Version 1 remains the default during the initial rollout.
- Version 2 is not release-ready before PR 10.