Release tags now fail closed without signing secrets, ship a signed Windows PE via house signerd, and replace per-arch Darwin tarballs with one stapled universal archive. Co-authored-by: Cursor <cursoragent@cursor.com>
