Fix Authenticode CI validation with psign 0.6.2

[Marc-André Moreau (mamoreau-devolutions)]

Summary

• Windows packages dry-run failed validating ACS-signed PEs: timestamp required by policy but no cryptographically valid trusted RFC3161 timestamp token was found.
• Signatures were good (Windows Authenticode Valid). The bug was in psign 0.6.1 portable RFC3161 trust.

Fix

• Bump CI psign-tool pin to 0.6.2 (psign-tool-linux-x64.zip SHA256 updated).
• Restore full portable trust policy for project-owned PEs:

  psign-tool portable trust-verify-pe \
    --prefer-timestamp-signing-time \
    --require-valid-timestamp \
    --allow-loose-signing-cert \
    --online-aia
  

• Keep verify-pe + signer CN checks for project-owned and Microsoft runtime PEs.
• Keep an explicit embedded RFC3161 attribute presence check on project-owned PEs for clearer failures.

Upstream

• psign fix: fix(portable-trust): accept ACS/Microsoft RFC3161 timestamp tokens psign#30
• psign release: https://github.com/Devolutions/psign/releases/tag/v0.6.2

Failed run

https://github.com/Devolutions/windbg-tool/actions/runs/31491249545/job/93780036559

[Marc-André Moreau (mamoreau-devolutions)]

Confirmed with a psign investigation session:

• ACS-signed PE signatures are good (Windows Valid + embedded MS nested RFC3161).
• Failure was psign portable trust, not Trusted Signing.
• Upstream fix: fix(portable-trust): accept ACS/Microsoft RFC3161 timestamp tokens psign#30
• After that lands in a published psign release, bump the pin here and restore --require-valid-timestamp (keep --allow-loose-signing-cert --online-aia for ACS EKU/AIA).

[Marc-André Moreau (mamoreau-devolutions)]

psign 0.6.2 is published. This PR now:

1. Pins PSIGN_VERSION=0.6.2 + linux-x64 zip SHA256
2. Restores --require-valid-timestamp (with --prefer-timestamp-signing-time --allow-loose-signing-cert --online-aia) for project-owned ACS PEs