[Bug]: Application blocked by Windows Smart App Control (SAC) due to missing digital signature

### Environment
- **OS:** Windows 11 (23H2 / 24H2 or newer)
- **Feature enabled:** Smart App Control (SAC)
- **App Version:** v1.4.102 (Latest binary built on June 27, 2026)

### Description
The Windows 11 desktop application (`orca.exe`) is being blocked immediately upon execution by Windows **Smart App Control (SAC)**.

Since the binary does not possess a trusted digital signature (Code-Signing Certificate), Microsoft's cloud-based AI infrastructure automatically treats it as an untrusted or low-reputation application and prevents it from running completely.

Furthermore, because the file is deployed under `AppData\Local\Programs\orca`, Windows treats the issue strictly as an SAC cloud block rather than a simple download (ZoneID / Mark-of-the-Web) issue. As a result, the standard "Unblock" checkbox does not even appear in the file properties, meaning users cannot easily whitelist it without permanently turning off Smart App Control at the OS level.

### Steps to Reproduce
1. Enable **Smart App Control** on Windows 11.
2. Download and install/extract the latest Windows `.exe` build of Orca.
3. Attempt to launch `orca.exe`.
4. Windows Security intercepts the process and throws a "Smart App Control blocked an app that may be unsafe" error message.

### Temporary Workaround Found
During testing, we discovered a specific workaround that allows the app to launch without permanently disabling system security:
1. Turn **OFF** Smart App Control in Windows Settings.
2. Launch `orca.exe` at least once while SAC is disabled.
3. Turn Smart App Control back **ON** and reboot the PC.
4. After this sequence, Windows bypasses the block and allows `orca.exe` to run normally even with SAC active.

While this unblocks individual users who find this trick, it is a tedious process and most general users will simply be blocked and unable to use the app.

---

### References & Additional Context

To support this report, here are official resources and examples from other prominent open-source projects facing the exact same block due to Windows 11 Smart App Control (SAC).

#### 1. Official Microsoft Documentation on SAC
- **Overview & Compliance:** Microsoft states that SAC blocks untrusted/unsigned applications to protect the OS. ([Microsoft Learn - SAC Overview](https://learn.microsoft.com/en-us/windows/apps/develop/smart-app-control/overview))
- **Code Signing Requirements:** Obtaining a code-signing certificate is identified as the definitive fix to pass SAC evaluation automatically. ([Microsoft Learn - Code Signing for SAC](https://learn.microsoft.com/en-us/windows/apps/develop/smart-app-control/code-signing-for-smart-app-control))

#### 2. Mechanics of Cloud-Based Reputation
While unverified apps might gain reputation over time as telemetry data accumulates, each new binary release resets this reputation counter to zero. Relying on cloud-based trust accumulation is therefore unsustainable for active projects with frequent updates.

#### 3. Prior Precedents in Other OSS & Developer Tools
This is a widespread issue for legitimate, unsigned open-source desktop applications:
- **Sublime Text / Merge Forum:** Reports show clean updates blocked by SAC, highlighting the issue of reputation resetting on new releases. ([Sublime Text Forum](https://forum.sublimetext.com/t/windows-11-smart-application-control-blocking-sublime-text-merge-request-for-code-signing-support/77928))
- **TeXstudio Issue 3689:** Active community discussion on SAC blocking legitimate installations. ([GitHub - TeXstudio Issue #3689](https://github.com/texstudio-org/texstudio/issues/3689))
- **Hermes Desktop Issue 536:** Examples of installation failures due to missing certificates. ([GitHub - Hermes Desktop Issue #536](https://github.com/fathah/hermes-desktop/issues/536))