[oddessentials]

Signs the Windows release with Agent Guild's Artifact Signing profile, as Grove Companion and World do.

• sign-windows (in release-signing, OIDC only) takes the build's zip after checking its SHA-256, signs AgentGuildBuilders.exe with the pinned SignTool, zips it again, runs the smoke tests on the signed exe and requires a valid, timestamped signature from WINDOWS_PUBLISHER.
• The release only takes the signed zip. Both zips are checked against their jobs' hashes, staged in a draft, read back, and only then published. A public release is never replaced, a draft is reused only when its commit and files match, and an older rerun can't become latest.
• Godot's editor and export templates are checked against their published SHA-512 pins.
• Asset names, download URLs and automatic releases on merge are unchanged. macOS is unchanged.

🤖 Generated with Claude Code