Code-sign and attest community release artifacts across platforms

[Shreyas582]

Scope

Harden community release trust by adding artifact signing and verification guidance across supported platforms.

Acceptance Criteria

• Windows release artifacts are code-signed (or documented as unsigned with explicit roadmap/controls if cert unavailable).
• macOS release artifacts include signing/notarization status and validation steps.
• Linux artifacts include signature/attestation strategy with documented verification flow.
• Release workflow publishes verification metadata alongside SHA256SUMS and SBOM.
• Security/release docs updated with operator verification steps.