test: add unit coverage for pickSignableFile/pickCertificateFile Browse and zero-results dialog branches

Problem

The pickSignableFile and pickCertificateFile functions in src/extension.ts have several VS Code UI interaction branches that lack unit test coverage:

1. Browse selected — When the user selects "Browse…" from the QuickPick, selectFile() (which wraps vscode.window.showOpenDialog) is called. This branch is not tested.
2. Zero artifacts found — When no artifacts/certificates are found in the workspace, the function falls back directly to selectFile() without showing a QuickPick. This branch is not tested.
3. Certificate Browse — Same as #1 but for the certificate picker flow.

The E2E test for Browse (sign-quickpick.spec.ts) is explicitly a smoke test because Playwright cannot interact with native OS file dialogs.

Proposed solution

Extract pickSignableFile and pickCertificateFile into a testable module (similar to the sign-flow.ts extraction done in #100) with an injectable adapter for showQuickPick and showOpenDialog, then add unit tests covering:

• Browse selection triggers showOpenDialog with correct filters
• Zero-results triggers showOpenDialog directly (no QuickPick shown)
• Certificate Browse path invokes showOpenDialog with certificate filters

Additional context

Surfaced during PR review of #100. This is a pre-existing coverage gap not introduced by that PR.

Start in src/extension.ts with pickSignableFile and pickCertificateFile, then review the sign-flow.ts extraction from #100. Use sign-quickpick.spec.ts for the existing Browse behavior and add unit coverage for Browse, zero-results, and certificate filters; done means the relevant showOpenDialog calls and QuickPick behavior are asserted.