Stabilize Windows trusted signing setup

[badcuban]

What changed

• pin the Azure TrustedSigning PowerShell module to 0.5.8
• stage it in a deterministic runner directory
• export that directory through PSModulePath for electron-builder child processes
• fail before packaging unless Invoke-TrustedSigning resolves

Why

Nightly release run 29979882247 failed in the Windows installer job after electron-builder installed TrustedSigning in one PowerShell process but could not resolve Invoke-TrustedSigning in the signing process. macOS, Linux, release smoke, and release preparation succeeded.

This preserves mandatory Authenticode signing while removing PowerShell module discovery from the critical packaging path.

Validation

• vp fmt
• vp lint
• vp run typecheck
• vp run release:smoke
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
threadlines	Ready	Preview, Comment	Jul 23, 2026 5:18am