Use the shared gitflow, Windows signing and release publish

[its-janghoon]

Summary

Converts this repository to the redrob-labs shared gitflow / signing / publish pieces.

• .github/workflows/gitflow.yml: verbatim copy of the organization caller template. Branch names and the back-merge check (gitflow / branch name follows the convention, gitflow / main is contained in develop) are the organization's; the shared job opens the back-merge PR itself, so branch-sync.yml is deleted.
• .github/workflows/tag-hygiene.yml: this repository's own tag rule (no workflow pushes tags in bulk), moved out of gitflow.yml unchanged.
• Branch types now follow the organization list; feature/ becomes feat/ in AGENTS.md and docs/BRANCHING.md.
• .github/workflows/release.yml:
  • sign-windows: the inline signing recipe (script/sign-windows.ps1 + read-back steps, deleted) is replaced by redrob-labs/.github/actions/sign-windows, called after each azure/login (OIDC) in the same build -> login -> sign order, binaries first, installer second. A failed signature or installer build now fails the job instead of degrading to an unsigned release with a warning.
  • new assets job keeps what only this repository knows: Linux zip/tar.gz, Redrob Launcher asset copies (launcher-assets.ts), the VERSION marker install.sh reads, and build provenance. Build jobs upload release-* artifacts.
  • new tag job (skipped on dry run) pushes the annotated tag, exactly as the old publish step did, and prints the promotion link.
  • publish is release-publish.yml@main with publish: true, launcher_manifest: true, and tag/target passed explicitly because the release is dispatch-driven; its if does not depend on github.ref_type.
• Unchanged: version resolution (bump input, tags as state, one pinned sha), the Bun build, macOS signing/notarization, Linux packaging.

Behaviour changes to know about

• Checksums file is now SHA256SUMS.txt (was SHA256SUMS) and also covers VERSION. No script in this repository reads either file; docs updated.
• Release notes are GitHub's generated notes. The hand-written notes (install snippet, signing provenance, "built on opencode vX") are gone; the upstream version remains in the tag message and UPSTREAM_VERSION.
• Windows signing is no longer best-effort: unset ARTIFACT_SIGNING_* still produces unsigned files with a warning (shared action), but a failing signature fails the release.

Verification

• actionlint -shellcheck= clean on release.yml, gitflow.yml, tag-hygiene.yml.
• tag-hygiene gate run locally over all workflows: clean.
• bun test test/installation/launcher-assets.test.ts: 7 pass.
• Dry run of release.yml on this branch: see the comment below for the run id and the Windows signing result.

[its-janghoon]

Dry run on this branch: run 38607867344 -- version, build, sign-macos, sign-windows, assets all green; tag and publish skipped (dry_run=true).

Windows job log, from the shared action's read-back:

dist\redrob-windows-arm64\bin\redrob.exe signed by CN=McKinley Rice, Inc.
dist\redrob-windows-x64\bin\redrob.exe signed by CN=McKinley Rice, Inc.
dist\redrob-windows-x64-baseline\bin\redrob.exe signed by CN=McKinley Rice, Inc.
dist\redrob-code-x64-setup.exe signed by CN=McKinley Rice, Inc.