Sign Windows release binaries

[3vcloud]

Summary

• add the Certum SimplySign helper scripts used by GWToolbox
• authenticate and sign the Windows asset in rolling and versioned release workflows
• skip signing when the Certum secrets are unavailable

Testing

• parsed both workflow files as YAML
• verified copied scripts match GWToolbox byte-for-byte
• bash -n .github/scripts/install-simplysign.sh
• npm ci && npm run build
• dotnet publish -c Release for win-x64, linux-x64, osx-x64, and osx-arm64
• Android publish attempted; blocked locally because the Android SDK is unavailable