Complete Windows signing provider onboarding

Question

Complete the external Windows signing-provider onboarding required before the release workflow can be implemented.

If the pending SignPath Foundation application is approved, configure OpenBeat’s project, signing policy, and GitHub Actions integration prerequisites.
If SignPath is declined or unavailable by the launch deadline, provision Azure Artifact Signing Public Trust Basic for the release month with narrowly scoped GitHub OIDC access.
Record the selected provider, non-secret resource identifiers, access/approval requirements, and any provider-specific constraints needed by Implement Windows Authenticode signing in the release workflow.

Do not place signing credentials or private identifiers in the issue.