ci(release): require trusted Windows signing

.github/workflows/release.yml

@@ -110,13 +110,39 @@ jobs:
           npm run build --workspace=@d3ro/desktop
 
       - name: Package with Electron Builder (NSIS x64)
+        shell: pwsh
         run: |
-          cd apps/desktop
-          npx electron-builder --win --x64 --config electron-builder.yml
+          $ErrorActionPreference = 'Stop'
+          if ([string]::IsNullOrWhiteSpace($env:CSC_LINK)) {
+            throw 'WIN_CSC_LINK must contain the production code-signing PFX path, URL, or base64 payload.'
+          }
+          if ([string]::IsNullOrWhiteSpace($env:CSC_KEY_PASSWORD)) {
+            throw 'WIN_CSC_KEY_PASSWORD is required.'
+          }
+          if ([string]::IsNullOrWhiteSpace($env:WIN_CSC_EXPECTED_SIGNER_SUBJECT)) {
+            throw 'WIN_CSC_EXPECTED_SIGNER_SUBJECT is required.'
+          }
+          if ($env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -match '(?i)Everything2EverythingDev') {
+            throw 'The local Everything2EverythingDev certificate is not a production signing identity.'
+          }
+          $releaseVersion = node -p "require('./release/product-version.json').version"
+          Push-Location apps/desktop
+          try {
+            npx electron-builder --win --x64 --config electron-builder.yml
+            if ($LASTEXITCODE -ne 0) { throw "electron-builder failed with exit code $LASTEXITCODE." }
+          }
+          finally {
+            Pop-Location
+          }
+          & scripts/ci/verify-windows-release-artifact.ps1 `
+            -ExpectedVersion $releaseVersion `
+            -ExpectedSignerSubject $env:WIN_CSC_EXPECTED_SIGNER_SUBJECT `
+            -ReleaseDirectory "apps/desktop/release/$releaseVersion"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
+          WIN_CSC_EXPECTED_SIGNER_SUBJECT: ${{ secrets.WIN_CSC_EXPECTED_SIGNER_SUBJECT }}
 
       - name: Upload Windows Build Artifacts
         uses: actions/upload-artifact@v4