Sign Windows CLI builds with a code certificate

Windows now trusts the TofuPilot CLI out of the box, removing the "unknown publisher" SmartScreen warning that appeared when running downloaded builds.

• Signed the Windows CLI executable with a new code-signing certificate issued to TofuPilot SA
• Verified every release build carries a valid signature before it ships