Prepare SignPath code-signing readiness for winTerm 1.1.3

[HelloThisWorld]

Summary

Prepare the repository for a SignPath Foundation OSS code-signing application: add the canonical code signing policy and readiness audit, protect release surfaces with CODEOWNERS and an explicit external-review policy, align shim binary version metadata with the canonical version, and fix the release-notes generator bug that duplicated the Signing section on the published v1.1.3 Release.

No runtime behavior, terminal behavior, UI interaction, or data format changes. No version bump, tag, or release is created.

Related issues

None.

Detailed changes

• CODE_SIGNING_POLICY.md (new, canonical): exact SignPath attribution sentence, Authors/Committers/Reviewers/Approvers, manual-approval requirement, build provenance, artifact ownership boundaries (winTerm-owned vs modified upstream vs third-party), privacy and install/uninstall links, and the honest current status (latest release unsigned, no certificate issued).
• README.md: links the canonical policy and states the current unsigned status in the existing Code signing policy section.
• CONTRIBUTING.md: external contributions require maintainer review explicitly covering CI, workflows, build/packaging scripts, dependency downloads, and signing configuration.
• .github/CODEOWNERS (new): covers .github/, scripts/winterm/, build/, packaging/, version/branding metadata, and policy documents. Effective only once branch protection requires code-owner review (server-side, tracked as a manual prerequisite).
• PRIVACY.md: version-neutral wording ("Current winTerm releases", "a future release") replacing "winTerm 1.0"; all statements preserved and still validated by test-privacy.ps1.
• SUPPORT.md: current Stable defined by the latest official Release link instead of a hard-coded 1.0.2.
• src/winterm-tools/winterm-shim/winterm-shim.rc: FILEVERSION/PRODUCTVERSION 1,1,3,0 and display versions 1.1.3, matching src/winterm/Branding/version.json. The published v1.1.3 assets still contain the older 1.0.0/1.0.8.0 shim metadata (released assets are immutable); the next release picks this up.
• scripts/winterm/verify-version.ps1: new assertions fail the pipeline on any future shim version-resource drift (numeric and display versions plus ProductName).
• scripts/winterm/generate-release-artifacts.ps1: the unsigned-disclosure guard now recognizes "not Authenticode-signed" (the narrow match caused the duplicate ## Signing section on the v1.1.3 Release body), and every generated Release body now carries Code signing policy and Privacy policy links.
• scripts/winterm/test-release-workflow.ps1: disclosure boundaries updated to the new generator text plus the policy-link requirements.
• docs/releases/1.1.3.md: adds the Policies links section.
• docs/signing/signpath-readiness.md (new): SignPath checklist split into completed / verified externally / known gaps / manual prerequisites / blocked, including the high-priority upstream-fork-visibility application blocker (repository is not a GitHub-visible fork of microsoft/terminal).

The published v1.1.3 GitHub Release body was separately corrected through the GitHub API (duplicate Signing section removed, Policies links added); its tag and assets are untouched.

Validation performed

• .\scripts\winterm\test.ps1 -Suite Smoke — passed (exit 0) on Windows 11 x64, Windows PowerShell; includes script syntax, version consistency (with the new shim assertions), branding, release-workflow boundaries, shell/workspace/pane static checks, and privacy validation.
• .\scripts\winterm\verify-version.ps1 — passed.
• .\scripts\winterm\test-privacy.ps1 — passed.
• Not run locally: full MSBuild x64 build and compiled test suites (no local build toolchain); this branch changes no compiled source other than the shim .rc version resource, and CI validation covers the rest.

Checklist

• The change is focused and does not include unrelated formatting.
• Tests were added or updated where appropriate.
• All tests claimed above actually ran and passed.
• User-facing behavior and limitations are documented in this repository.
• Version or schema changes include compatibility and migration notes.
• Package identity, winterm.exe, and Microsoft Terminal coexistence remain isolated.
• No command text, terminal output, clipboard content, credentials, or private paths are logged.
• New source and script files contain the appropriate MIT license header.
• I did not include generated build output, secrets, certificates, or local absolute paths.