winui-packaging: add production signing & distribution guidance (Azure Trusted Signing, .appinstaller, EV/OV certs)

97: #97

Problem

From Joe's blog post:

It is also worth noting that the WinUI Skill and the WinApp CLI are no help signing the MSIX package for distribution. Luckily I had already worked out signing my artifacts, but that was a serious pain to get repeatable.

Our winui-packaging skill (SKILL.md) covers dev-cert signing thoroughly but production is reduced to a single bullet:

--timestamp is critical for production — without it, signatures expire with the cert

That leaves both the agent and the user with no playbook for the actual hard part: how do I get a certificate anyone else's machine will trust? How do I ship updates without re-installing? What does the agent recommend in 2026 — buy an OV cert, an EV cert, or use Azure Trusted Signing?

What's missing

• Azure Trusted Signing — Microsoft's current recommended path; ~$10/mo, no cert lifecycle management, OV trust by default. Today the skill doesn't mention it.
• EV vs OV cert tradeoffs — when each is needed, cost, where to buy, SmartScreen reputation implications.
• Sideload-friendly distribution — .appinstaller files, hosting requirements, MIME types, auto-update channels.
• Cert renewal flow — what to do when an existing cert is about to expire; re-sign without breaking existing installs.
• MSIX Hero mention as the de-facto manual diagnostic tool.
• Trusted publisher chain explanation — why winapp cert install for a dev cert is not what a customer's machine needs.

Proposed shape

Add plugins/winui/skills/winui-packaging/references/production-signing.md and reference it from SKILL.md under a new "Production distribution" section. Update the skill front-matter description so the agent loads the skill when asked about production signing or distribution channels, not just dev-cert packaging.

Acceptance criteria

• Agent can answer "how do I sign this app for the Microsoft Store / sideload / enterprise install" without hand-waving.
• Azure Trusted Signing is presented as the recommended default with concrete setup steps.
• .appinstaller flow documented for self-hosted distribution with auto-update.
• Cert renewal + countersign-with-timestamp guidance.
• Skill front-matter mentions "production signing" so it loads on intent.

Acknowledgments

Identified by Joe Finney in Building Fluent Icon Finder with the WinUI Copilot skill.

Start by reading plugins/winui/skills/winui-packaging/SKILL.md and its current front matter, then use the proposed references/production-signing.md as the documentation entry point. Done means the skill references production guidance covering Azure Trusted Signing, certificate choices and renewal, .appinstaller distribution, trusted publisher chains, and the listed acceptance questions.