Document and verify reproducible release builds and provenance

[darkbyte-JS]

Goal

Make it possible to compare clean builds and explain unavoidable Authenticode/timestamp differences.

Acceptance criteria

• Pin and document SDK, NuGet, Windows SDK, and build inputs.
• Compare unsigned payload hashes from two clean environments.
• Generate an SPDX SBOM and SHA-256 manifest in CI.
• Document signing as a separate, protected release step.
• Do not introduce or export a private signing key.