fix(ci): pass the sign command with --config and prove the uninstaller was signed

The first signing run built nothing signed, and "Verify signatures" failed
it as intended. The Tauri 2 CLI never reads TAURI_CONFIG. It only sets that
variable for tauri-build, so the sign command was dropped silently, just as
the inline beforeBuildCommand override had been for as long as the Windows
jobs have set it. The setup now writes a config file, and the build passes
it with `cargo tauri build --config`.

Review follow-ups:
- The NSIS uninstaller is written to %TEMP% and signed from 32-bit makensis.
  SYSTEM's %TEMP% sits under System32, which WOW64 redirects for makensis but
  not for the x64 signtool, so they would disagree about where the file is.
  %TEMP% and %TMP% now point into the workspace. makensis ignores the sign
  command's exit code for the uninstaller, so windows-sign.ps1 logs every
  file it signs, and the verify step requires a logged signature under that
  temp directory.
- The signing client is pinned by SHA-512, so the pin can be checked against
  nuget.org's published packageHash.
- tauri-cli on Windows is pinned to =2.11.0 --locked, the @tauri-apps/cli
  version the Linux and macOS jobs run from the lockfile, instead of "^2".

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

scripts/windows-sign.ps1

@@ -47,7 +47,14 @@ $arguments = @(
 $ErrorActionPreference = 'Continue'
 for ($attempt = 1; $attempt -le 3; $attempt++) {
     & $env:TRIPLE_C_SIGNTOOL @arguments 2>&1 | ForEach-Object { "$_" }
-    if ($LASTEXITCODE -eq 0) { exit 0 }
+    if ($LASTEXITCODE -eq 0) {
+        # The evidence "Verify signatures" needs for files it cannot see
+        # afterwards - the NSIS uninstaller is embedded in the installer.
+        if ($env:TRIPLE_C_SIGN_LOG) {
+            [IO.File]::AppendAllText($env:TRIPLE_C_SIGN_LOG, "$Path`n", (New-Object System.Text.UTF8Encoding $false))
+        }
+        exit 0
+    }
     Write-Host "signtool exited $LASTEXITCODE signing $Path (attempt $attempt of 3)"
     if ($attempt -lt 3) { Start-Sleep -Seconds (10 * $attempt) }
 }