ci: sign only what ships, stop signing previews, log signing output

Artifact Signing is metered at about 1000 signatures a month, and there
were 67 Windows builds last month.

- windows-sign.ps1 signs only what reaches users: the app binary, the MSI,
  the NSIS installer and the uninstaller. It skips the WiX extension DLLs
  and NSIS plugins that Tauri also offers, and any file that is already
  validly signed. That is 4 signatures per release.
- Previews are no longer signed, so the preview workflow no longer
  references the signing secrets. A PR's workflow runs the PR's own code.
  The inline TAURI_CONFIG there, which the v2 CLI never read, becomes a
  real `--config`.
- Tauri reports a failed sign command only as "failed to run powershell".
  The script now keeps a transcript, signtool /debug included, and the
  release job prints it on failure.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-app.yml

@@ -686,6 +686,12 @@ jobs:
           app\src-tauri\target\release\bundle\msi\*.msi
           app\src-tauri\target\release\bundle\nsis\*.exe
 
+      # Tauri reports a failed sign command as just "failed to run powershell";
+      # windows-sign.ps1 keeps its own transcript, signtool /debug included.
+      - name: Show signing output
+        if: failure()
+        run: if exist .code-signing\sign-output.log type .code-signing\sign-output.log
+
       - name: Collect artifacts
         run: |
           set "PATH=%USERPROFILE%\.cargo\bin;C:\Program Files\nodejs;%PATH%"