DigiCert smctl is x64-only and silently fails under ARM64 emulation.
Previously signing ran inline during the build via CMake POST_BUILD,
which meant ARM64 builds shipped unsigned.
Now a single 'windows-sign' Buildkite step runs on an x64 agent after
all Windows build-bun steps complete. It downloads every bun-windows-*.zip,
signs the exes inside, and re-uploads with the same names so the release
step transparently picks up the signed artifacts.
The sign step runs when:
- On main with a non-canary build (normal release path), or
- The commit message contains [sign windows] (for testing on a branch)
DigiCert charges per signature, so canary builds are never signed.
Cleanup: removed ENABLE_WINDOWS_CODESIGNING CMake option, the inline
POST_BUILD signing in BuildBun.cmake, the secret-fetching block in
build.mjs, and the old sign-windows.ps1. upload-release.sh now pins
Windows artifact downloads to the windows-sign step when it ran to
guarantee the signed zips are the ones released.
0910e6f4cd