[ScriptedAlchemy]

Windows release executables are unsigned. Remove the unused SignPath portal configuration and clarify this in SECURITY.md and the user guide. Archive checksums and build-provenance attestations remain available; they do not provide an executable code signature.

The shared runtime repairs previously carried here have landed on master. The remaining diff is limited to the signing configuration deletion and documentation. Earlier focused release-safety, release-drift, dashboard-bundle, and release-PR-integrity checks passed for this cleanup.

On f643eaf, repository gates, Dashboard, Clippy, feature gates, and the shipped Linux CLI build have passed. The Linux fleet test is still running; its result and the aggregate must pass before merge. Current CI.

Fixes #4341.

[changeset-bot]

⚠️ No Changeset found

Latest commit: f643eaf

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[ScriptedAlchemy]

Pushed dcf78fedef54e08ce9dab33c499359b371bce11a for the inherited hook journey failure in CI run 39519779223. Both failed attempts were legitimately accepted for replay; the test assumed that its single retry would satisfy the unchanged 25 ms acknowledgement deadline.

The journey now retries the same immutable Stop event only after a completed accepted_for_replay, retryable: true receipt and typed replay Drained readiness. It uses one existing 180-second deadline across attempts. Exact guidance, single emission, duplicate suppression, and decision-engine assertions remain; production behavior and budgets are unchanged.

Pinned rustfmt, diff checks, and commitlint pass. Native execution is delegated to the new CI run.

This fixes the shared hook fixture. The separate fact_detail_keeps_a_superseded_fact_readable_by_id HTTP timeout in the previous run is not addressed by this change and remains for the new CI run to diagnose.