ci(release): signing waterfall so forks build without upstream secrets

Forks do not inherit repository secrets, and the previous hardwired
Azure Trusted Signing steps failed the Windows job outright on a fork.
Each signing step is now gated on its credentials being present and the
pipeline falls through: Azure Trusted Signing (upstream setup, unchanged
when the secrets exist) -> PFX certificate from WINDOWS_PFX_BASE64 /
WINDOWS_PFX_PASSWORD via signtool with RFC-3161 timestamping -> unsigned
with a note in the job summary. The build and installer assembly always
complete.

.github/workflows/release.yml

@@ -237,7 +237,11 @@ jobs:
           cargo build --locked --release
           cargo build --locked --release -p dwg-thumbnailer-win
 
+      # Forks do not inherit repository secrets, so every signing step is
+      # gated on its credentials being present and the pipeline falls through:
+      # Azure Trusted Signing (upstream setup) -> PFX certificate -> unsigned.
       - name: Sign executable (Azure Trusted Signing)
+        if: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME != '' }}
         uses: azure/artifact-signing-action@v2
         with:
           azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -251,6 +255,37 @@ jobs:
           timestamp-rfc3161: http://timestamp.acs.microsoft.com
           timestamp-digest: SHA256
 
+      - name: Import signing certificate (PFX fallback)
+        if: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME == '' && secrets.WINDOWS_PFX_BASE64 != '' }}
+        shell: pwsh
+        env:
+          WINDOWS_PFX_BASE64: ${{ secrets.WINDOWS_PFX_BASE64 }}
+        run: |
+          $pfxPath = Join-Path $env:RUNNER_TEMP "signing.pfx"
+          [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($env:WINDOWS_PFX_BASE64))
+          "Imported signing certificate to $pfxPath"
+
+      - name: Sign executable (certificate)
+        if: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME == '' && secrets.WINDOWS_PFX_BASE64 != '' }}
+        shell: pwsh
+        env:
+          WINDOWS_PFX_PASSWORD: ${{ secrets.WINDOWS_PFX_PASSWORD }}
+        run: |
+          $signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin" -Recurse -Filter signtool.exe |
+            Where-Object { $_.DirectoryName -match 'x64' } |
+            Sort-Object FullName -Descending | Select-Object -First 1 -ExpandProperty FullName
+          if (-not $signtool) { throw "signtool.exe not found in the Windows SDK" }
+          & $signtool sign /fd SHA256 /tr https://timestamp.digicert.com /td SHA256 `
+            /f (Join-Path $env:RUNNER_TEMP "signing.pfx") /p $env:WINDOWS_PFX_PASSWORD `
+            (Resolve-Path target\release\OpenCADStudio.exe).Path
+          if ($LASTEXITCODE -ne 0) { throw "signtool failed for the executable" }
+
+      - name: Note unsigned executable
+        if: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME == '' && secrets.WINDOWS_PFX_BASE64 == '' }}
+        shell: pwsh
+        run: |
+          "No signing credentials configured - add the Azure Trusted Signing secrets or WINDOWS_PFX_BASE64/WINDOWS_PFX_PASSWORD to sign. Building UNSIGNED." >> $env:GITHUB_STEP_SUMMARY
+
       - name: Build MSI installer
         shell: pwsh
         run: |
@@ -283,8 +318,9 @@ jobs:
           if ($LASTEXITCODE -ne 0) { throw "light failed" }
 
       - name: Sign MSI installer (Azure Trusted Signing)
-        # The installer itself must be signed separately — light produces a
+        # The installer itself must be signed separately - light produces a
         # fresh, unsigned .msi even though the .exe inside is already signed.
+        if: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME != '' }}
         uses: azure/artifact-signing-action@v2
         with:
           azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -298,6 +334,27 @@ jobs:
           timestamp-rfc3161: http://timestamp.acs.microsoft.com
           timestamp-digest: SHA256
 
+      - name: Sign MSI installer (certificate)
+        if: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME == '' && secrets.WINDOWS_PFX_BASE64 != '' }}
+        shell: pwsh
+        env:
+          WINDOWS_PFX_PASSWORD: ${{ secrets.WINDOWS_PFX_PASSWORD }}
+        run: |
+          $signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin" -Recurse -Filter signtool.exe |
+            Where-Object { $_.DirectoryName -match 'x64' } |
+            Sort-Object FullName -Descending | Select-Object -First 1 -ExpandProperty FullName
+          if (-not $signtool) { throw "signtool.exe not found in the Windows SDK" }
+          & $signtool sign /fd SHA256 /tr https://timestamp.digicert.com /td SHA256 `
+            /f (Join-Path $env:RUNNER_TEMP "signing.pfx") /p $env:WINDOWS_PFX_PASSWORD `
+            (Resolve-Path OpenCADStudio.msi).Path
+          if ($LASTEXITCODE -ne 0) { throw "signtool failed for the MSI" }
+
+      - name: Note unsigned MSI
+        if: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME == '' && secrets.WINDOWS_PFX_BASE64 == '' }}
+        shell: pwsh
+        run: |
+          "MSI left unsigned - no signing credentials configured." >> $env:GITHUB_STEP_SUMMARY
+
       - name: Upload artifacts to release
         if: env.RELEASE_TAG != ''
         shell: pwsh