test: Fix the certificate mock scoping and cover the signing surface

[tablackburn]

Closes #216. Closes #217.

What was wrong

Six Mock Get-ChildItem statements in tests/Get-PSBuildCertificate.tests.ps1 had no
-ModuleName, so they never reached the call Get-PSBuildCertificate makes inside the module.
Three of the tests they backed asserted the real certificate store was empty: green on CI and on
any workstation without a code-signing certificate, red on a maintainer's. Reproduced first —
Should -Invoke Get-ChildItem -Times 0 -Exactly passed, and a certificate stood into the store
turned the test red.

Invoke-PSBuildModuleSigning had eleven passing tests and none called it; its two file-discovery
tests counted Get-ChildItem results in the test body, asserting a fact about PowerShell rather
than about this module.

What changed

Certificate tests. The six mocks are module-scoped, following the SkipValidation context
from #194. The three store tests now return an expired certificate, one with no private key, and
one whose thumbprint is not the one asked for, so each exercises the filter it is named after; two
more cover a store that holds a usable certificate. Three guard clauses that had never run are
covered too: the empty thumbprint, the unset variable, and the Store source's refusal off Windows.

The post-load validation block — private key, expiry, Code Signing extended key usage — runs for
the first time, driven by objects carrying the properties the function reads. Generated
certificates cannot do this job: EnhancedKeyUsageList comes from PowerShell's own type data, and
one and the same certificate reports the usage on Windows PowerShell 5.1 and an empty list on
PowerShell 7.

One module change. The EnvVar and PfxFile sources constructed an X509Certificate2
directly, and a constructor is not a command, so nothing could stand in for it — which is why the
validation after it had never executed. Private/Import-PSBuildX509Certificate.ps1 names that
load as a command: same overloads, same exceptions propagating, no validation, no store writes.
Three tests drive it with a real PFX — password-less with the password variable unset, protected
with the password supplied, and protected with the wrong password, which proves the password is
used at all.

An earlier revision guarded the password so a $null from an unset variable would not become
"". That distinction does not exist, so the guard and its comment are gone. Measured on both
editions against a password-less PFX, a protected one, and one exported with an explicitly empty
password, each loaded with a genuine null ([NullString]::Value), with "", and via the
single-argument overload: null and empty behave identically in every cell, and only the
single-argument overload differs at all. The guard could not have acted on the distinction anyway
— an unbound [string] parameter is "", not $null, and [NullString]::Value collapses to
"" when bound to one.

Signing tests. The two misnamed tests are replaced by tests that call the function with
Set-AuthenticodeSignature mocked inside the module: the search recurses, the Include patterns
filter, the certificate, timestamp server, and hash algorithm reach the signing cmdlet rather than
being accepted and dropped, the defaults are the documented ones, and a signature comes back per
file. One Windows-only test signs for real against a self-signed certificate created for the run
and removed from the store in AfterAll however the tests end; an empty timestamp server keeps it
off the network. Platform guards use the #197 shape, and its mirror for the non-Windows test.

Coverage and verification

File	Before	After
Get-PSBuildCertificate.ps1	65 of 95	93 of 95
Invoke-PSBuildModuleSigning.ps1	5 of 17	17 of 17
Import-PSBuildX509Certificate.ps1	—	3 of 3

The five instructions covered before in Invoke-PSBuildModuleSigning were its ValidateScript,
which runs at parameter binding; its body was at zero. The two still missed are the non-Windows
throw, covered on the Linux and macOS legs.

./build.ps1 -Task Test is green on PowerShell 7.6.5 / Windows: 614 passed, 0 failed, 4 skipped
(the fourth is the new non-Windows test), up from 591, and 27.6% to 31.2% overall. No new
PSScriptAnalyzer findings, Cert:\CurrentUser\My holds nothing the tests created, rebased on
main. No CHANGELOG.md entry: this is the test suite, and the module change is an internal seam
with no user-facing behaviour change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MxiVZmXp31BREi3aNDop5y

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Test Results

    4 files  ± 0    901 suites  +12   2m 30s ⏱️ +3s
  620 tests +24    617 ✅ +24   3 💤 ± 0  0 ❌ ±0 
2 463 runs  +96  2 369 ✅ +74  94 💤 +22  0 ❌ ±0 

Results for commit 8e55873. ± Comparison against base commit 3ea9e82.

This pull request removes 2 and adds 26 tests. Note that renamed tests count towards both.

Code Signing Functions.Invoke-PSBuildModuleSigning.Searches for files matching Include patterns
Code Signing Functions.Invoke-PSBuildModuleSigning.Uses custom Include patterns when specified

Code Signing Functions.Get-PSBuildCertificate.EnvVar mode.Loads a certificate from a PFX that carries no password
Code Signing Functions.Get-PSBuildCertificate.EnvVar mode.Loads a password-protected PFX with the password from the environment
Code Signing Functions.Get-PSBuildCertificate.EnvVar mode.Throws when the environment variable holds nothing
Code Signing Functions.Get-PSBuildCertificate.EnvVar mode.Throws when the password from the environment is the wrong one
Code Signing Functions.Get-PSBuildCertificate.Store mode.Returns a valid certificate that the store does hold
Code Signing Functions.Get-PSBuildCertificate.Store mode.Throws where there is no certificate store to search
Code Signing Functions.Get-PSBuildCertificate.Thumbprint mode.Returns the certificate whose thumbprint was asked for
Code Signing Functions.Get-PSBuildCertificate.Thumbprint mode.Throws when the thumbprint is empty
Code Signing Functions.Get-PSBuildCertificate.Validation of a certificate loaded from EnvVar or PfxFile.Applies the same validation to a certificate loaded from a PFX file
Code Signing Functions.Get-PSBuildCertificate.Validation of a certificate loaded from EnvVar or PfxFile.Hands the decoded payload and the password from the environment to the loader
…

♻️ This comment has been updated with latest results.