Sign Windows artifacts with Azure Artifact Signing #282

Goal

Sign the Windows artifacts shipped by FastLED/cli with Azure Artifact Signing
(formerly Trusted Signing), replacing the exportable fastled.pfx path.

Already done (2026-10-31)

• Repo secrets set: AZURE_SIGN_ENDPOINT, AZURE_SIGN_ACCOUNT,
  AZURE_SIGN_PROFILE, AZURE_SIGN_PUBLISHER, AZURE_TENANT_ID.
• Publisher identity + wiring map vaulted in zackees/keyz → azure-signing/.
• Subscription talos-signing exists; Artifact Signing account planned as
  zachvorhies-signing (East US, Basic, $9.99/mo, 5,000 signatures).

Still blocked upstream

1. Identity validation for the publisher (government ID + selfie via Microsoft
   Entra Verified ID; 1–20 business days). No certificate profile exists until
   it completes.
2. CI app registration + federated credential for this repo (preferred over a
   client secret), granted Artifact Signing Certificate Profile Signer scoped
   to the certificate profile only.

Work in this repo

• Add AZURE_CLIENT_ID (+ AZURE_CLIENT_SECRET, or OIDC id-token: write
  so there is no secret).
• Replace the fastled.pfx signing step with SignTool + the Artifact Signing
  digest DLL, or azure/artifact-signing-action@v0:
  signtool sign /fd SHA256 /tr http://timestamp.acs.microsoft.com /td SHA256 /dlib Azure.CodeSigning.Dlib.dll /dmdf metadata.json <file>
• Timestamping is mandatory — certificates are valid for 3 days only.
• metadata.json = {"Endpoint": "https://eus.codesigning.azure.net/", "CodeSigningAccountName": "zachvorhies-signing", "CertificateProfileName": "zachvorhies-public-trust"}.
• Verify on a clean Windows VM as a non-admin user: signtool verify /pa /v.

Constraints

• The publisher string must equal the certificate subject byte-for-byte; a
  mismatch makes SignerSign fail with ERROR_BAD_FORMAT (0x8007000B). For a
  signed MSIX/AppX the manifest Publisher must match it too.
• SmartScreen reputation accrues per publisher over consecutive releases; the
  first signed releases still warn, and switching identities resets it.
• One publisher identity covers every repo, so Talos and FastLED share the same
  reputation curve. Per-repo isolation is done by revoking that repo's federated
  credential, not by minting another certificate.