Document Windows Application Control limitations and safe alternatives

[Copilot]

Smart App Control can block Grimp’s unsigned Windows native extension. Users need clarity on publisher signing and options that preserve Windows protections.

• Signing status: Document the unsigned release pipeline and external signing prerequisites. This PR does not implement signed wheels.

• Safe alternatives: Explain integrity hashes versus signatures, the absence of a pure-Python fallback, and running existing architecture contracts on Linux CI.

• Diagnostics: Request sanitized Code Integrity events without assuming other Grimp versions are blocked.

• Add tests for the change. In general, aim for full test coverage at the Python level. Rust tests are optional.

• Add any appropriate documentation.

• Add a summary of changes to the latest section at the top of CHANGELOG.rst. (If it's not there, add it.)

• Add your name to AUTHORS.rst.

• Run just full-check.

• Fixes Windows Application Control blocks Grimp native extension — signed Windows wheels? #319

[codspeed]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 23 skipped benchmarks¹

---

_{Comparing copilot/fix-windows-application-control-block (16d9b29) with main (676e490)}

Footnotes

1. 23 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩