fix(release): initialize the Windows signing repository

[bjarn]

RC5 stopped before signing because PowerShell could not find PSGallery. The workflow assumed that the runner already had a usable package repository.

Add one setup script that restores the default repository when it is missing, requires the official HTTPS source, installs ArtifactSigning 0.1.8, and verifies that the signing command loads. Retry setup failures at most three times, with a five-minute step limit. Run setup before Azure login. Return success explicitly after verification because PackageManagement can leave a stale native NuGet exit code after recovery.

Use the same script in a Windows CI job that removes PSGallery, downloads and imports the real module, and repeats setup. Also test recovery from a transient error, the retry limit, stale exit codes, and refusal of an unexpected package source. This job needs no signing credentials.

Validation:

• PR CI, push CI, and actual Release workflow validation pass. The real Windows missing-repository recovery and module import tests pass.
• RC5 retry completed with the existing tagged code. Windows and macOS signing, six native package checks, PowerShell 5.1 and 7 installation, both Apple submissions, final macOS installer checks, provenance verification, and publication all passed. No tag change or new release was needed. This retry does not include the setup change in this PR.
• After publication, downloaded all 11 expected assets. All nine checksums and all ten attested files passed independent verification against the exact RC5 commit.
• Ran the public macOS installer twice with provenance verification in a temporary Unicode path. Publisher, notarization, version, initial installation, replacement, and removal passed. The temporary installation was removed.

Homebrew was skipped as expected for this pre-release. The first stable release must still run the Homebrew publication and installation checks.