fix(ci): refuse a signed build that is not on a tag

.github/workflows/build-electron.yml

@@ -39,6 +39,16 @@ jobs:
       version: ${{ steps.version.outputs.VERSION }}
       release_repo: ${{ steps.repo.outputs.RELEASE_REPO }}
     steps:
+      # Only a tag build publishes; a signed branch build paid for 24 eSigner signatures and discarded them (2026-09-15).
+      - name: Refuse to sign a build that cannot publish
+        if: github.ref_type != 'tag' && !inputs.skip_signing
+        env:
+          REF_TYPE: ${{ github.ref_type }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          echo "::error::skip_signing is off but this run is on $REF_TYPE '$REF_NAME'. Only a tag build publishes, so the signatures would be paid for and thrown away. Re-run from the version tag, or leave skip_signing checked."
+          exit 1
+
       - name: Check out Git repository
         uses: actions/checkout@v4
 

RELEASE.md

@@ -58,8 +58,12 @@ Then push the commit and the tag `npm version` created.
 
 ## 2. Desktop: build
 
-Run **Build / Electron** (`workflow_dispatch`) — `brand` defaults to `remoteit`,
-and **uncheck `skip_signing`** for a real release, since it defaults to `true`.
+Run **Build / Electron** (`workflow_dispatch`) **from the version tag** — in
+"Use workflow from", switch to Tags and pick `vN.N.N`, not `main`. `brand`
+defaults to `remoteit`; **uncheck `skip_signing`** for a real release, since it
+defaults to `true`. Only a tag build creates the draft and publishes into it; a
+branch build compiles and discards everything, so with `skip_signing` off the
+`prepare` job refuses to start rather than pay for signatures nobody receives.
 
 A `prepare` job first resolves the release repository for the selected brand
 (`brands/<brand>/config.ts` — `cachengo` publishes to `cachengo/desktop`) and