The launcher is signed

The release job used to publish Setup.exe, the packages and the feed unsigned. Launcher pull request #108 wires signing through Azure Artifact Signing: vpk pack signs every .exe, .dll and .node file it packs, the launcher, Update.exe and the stub, then Setup.exe, before it hashes the packages into the feed, so no later step changes a file the feed has hashed. Signtool runs with a SHA-256 digest and an RFC 3161 timestamp. Until the identity's secrets exist, the job publishes unsigned and says so, with a signed: false line at the end of the release notes, rather than failing or pretending.