Fix the eSigner signing path and remove Azure Artifact Signing

[NeuroKoder3]

Summary

Removes Azure Artifact Signing and makes SSL.com eSigner with an OV certificate the production Windows signing route — then fixes that route, which had never been run against a real certificate and would not have worked.

Azure Artifact Signing requires an organisation verifiable for three years or more. TransTrack Medical Software does not meet that bar, so the mode could not have been used, and keeping it would have left the validation package describing a signing path that cannot be demonstrated on request.

Defects found in ssl_esigner

Audited against SSL.com's CodeSignTool command guide. Three would each have been fatal on the first attempt:

Defect	Consequence
-totp_secret was given a generated 6-digit code	CodeSignTool derives the code itself from the secret. Fails as Error: invalid otp, which reads like a broken 2FA enrolment.
-overwrite is not a CodeSignTool option	Rejected as an unknown argument on every invocation.
Arguments passed as -name value	SSL.com documents -name=value throughout.

Two more in the same path:

• A password with shell metacharacters was silently corrupted. CodeSignTool is a .bat, so its arguments are re-parsed by cmd.exe — SSL.com's own example password is P!@^^ssword12. Values are now quoted, and the two characters that cannot survive quoting (" and %) are refused up front with an explanation rather than sent wrong and surfacing as an authentication failure. The PFX path no longer uses a shell at all, so Node quotes for it.
• A zero exit status was treated as proof of signing. CodeSignTool has been observed to print a failure and exit 0. Every mode now signs into a temporary directory, confirms a file was produced, moves it over the original, and re-reads the artifact to confirm it carries an embedded signature.

The now-unused RFC 6238 TOTP helpers were removed rather than left as an attractive nuisance.

Also

The release gate rejected nothing when handed TRANSTRACK_SIGN_MODE=azure — it silently fell through to auto-detect and reported a pass for a mode nobody asked for. An unrecognised mode, and skip, now fail explicitly.

Test plan

• signWin.test.cjs — 26 pass, including the CodeSignTool argument contract, the password-quoting rules, and the post-sign check (verified against a genuinely signed node.exe on Windows)
• core suite — 50/50 pass
• npm run lint, npm run typecheck — clean
• complianceDocs.test.mjs — traceability intact after the SDS edit
• Release gate exercised with ssl_esigner (pass), azure (fails as unsupported), skip (fails as unsigned)
• release.yml parses; jobs unchanged

Not verifiable here: an end-to-end signature against a real certificate. That needs the purchased OV certificate. The argument contract is now pinned to SSL.com's published spec by tests, so the remaining risk is account setup rather than code.

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.