SignPath Foundation signs only what a trusted build system built from the
repository, so releases move from local builds to a workflow. A tag push
builds, signs the three executables, compiles the installer around the
signed copies, signs the installer, and opens a draft release. A manual run
does the same under test-signing, without the release.
The README gains the code signing policy the Foundation requires, including
a privacy note for the Google Fonts request the remap window makes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
