docs(signing): publish SignPath application prerequisites

[Wangnov]

Summary

• publish the code-signing policy and privacy notice required for the SignPath Foundation application
• disclose the current Windows state accurately: installers are unsigned, the application is pending, and Tauri updater signatures are not Authenticode publisher trust
• add policy/privacy entry points to the README, release notes, and website, with the required SignPath attribution
• regenerate the website's subset fonts for the new Chinese copy

Explicit non-goals

• no SignPath CI or signing integration
• no release workflow, updater, or runtime behavior changes
• Draft PR feat(delivery): harden manager self-update and prepare SignPath migration #177 remains untouched

Validation

• codex review --uncommitted: no findings after two review iterations
• root: type check, ESLint, production build, and 275 tests passed
• Rust: 120 workspace tests, 24 macOS engine tests, 73 Windows engine tests, and Clippy passed
• website: clean install, font regeneration, production build, and Wrangler dry-run (34 assets) passed

Post-merge release work

• synchronize the existing v0.3.1 GitHub Release body while preserving its generated What's Changed section
• deploy the website and verify that /manager/* and /latest/* routes remain intact

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.