P2: Code signing for exe + installer (CI integration)

[Kinin-Code-Offical]

[Kinin-Code-Offical]

Plan:

• Add optional signing support to release workflow using base64 PFX secret.
• Sign both cloudsqlctl.exe and cloudsqlctl-setup.exe after build/installer when cert is present.
• Keep workflow no-op when signing secrets are not provided.

Risks:

• Incorrect secret configuration will cause signing to fail; ensure clear skip behavior.

Tests:

• npm ci
• npm run lint
• npm test
• npm run build
• npm run package
• npm run smoke:exe
• npm run installer
• npm run stage

[Kinin-Code-Offical]

Merged via #43
Merge commit: 20f5888

Notes:

• Signing is optional: if repo secrets CLOUDSQLCTL_SIGN_CERT_B64 / CLOUDSQLCTL_SIGN_PWD are not set, the release workflow will skip signing.
• CI/docs gate fixed by regenerating docs/commands.md.