Show which publisher to allow on Windows

When Windows blocked the CLI, the installer still said it was not code-signed, which sent IT looking for a fix that already exists.

• Updated the Windows installer's error messages to show the file's signature and give IT one line to act on: allow the publisher TofuPilot SA.
• Added guidance for unsigned preview builds, altered downloads, and files a security tool keeps locked.