What changed

• pin the Azure TrustedSigning PowerShell module to 0.5.8
• stage it in a deterministic runner directory
• export that directory through PSModulePath for electron-builder child processes
• fail before packaging unless Invoke-TrustedSigning resolves

Why

Nightly release run 29979882247 failed in the Windows installer job after electron-builder installed TrustedSigning in one PowerShell process but could not resolve Invoke-TrustedSigning in the signing process. macOS, Linux, release smoke, and release preparation succeeded.

This preserves mandatory Authenticode signing while removing PowerShell module discovery from the critical packaging path.

Validation

• vp fmt
• vp lint
• vp run typecheck
• vp run release:smoke
• git diff --check