Harden release signing and publishing

[henderkes]

Summary

• scope Certum credentials only to the authentication and signing steps
• disconnect SimplySign immediately after signing, including failure paths, and unregister certificates on disconnect
• remove insecure workflow-command compatibility and write the version through GITHUB_OUTPUT
• replace the mutable third-party release action with the preinstalled GitHub CLI

Security impact

The release publisher no longer runs while the cached signing session is active, and publishing cannot read the Certum TOTP seed, user ID, or certificate thumbprint. Dynamic version data is carried through the environment instead of being interpolated into generated PowerShell source.

Validation

• Actionlint v1.7.7 (ignoring only the repository's existing custom runner label)
• YAML parse for all workflows
• PowerShell syntax parse for all signing scripts
• command-shaped version regression check
• git diff --check