fix(ci): verify the binary inside the installers, not the loose target copy

The first fully signed run (signer CN=OLS Digital LLC) signed the app
binary, the MSI, the NSIS installer and the uninstaller, and skipped the
seven build-time DLLs. It still failed verification on
target\release\triple-c.exe. Tauri patches that file with bundle-type
information before each bundle, signs it, packages it, and patches it
again, so the loose copy is unsigned by design and is not what ships.

Verification now:
- checks the installers themselves;
- unpacks the MSI with `msiexec /a` and checks the binaries inside it;
- for NSIS, which can't be unpacked that way, requires the signing log to
  show that the app binary and the uninstaller were signed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-app.yml

@@ -682,7 +682,6 @@ jobs:
         run: >-
           powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass
           -File scripts\windows-verify-signatures.ps1
-          app\src-tauri\target\release\triple-c.exe
           app\src-tauri\target\release\bundle\msi\*.msi
           app\src-tauri\target\release\bundle\nsis\*.exe