[blocker]: Windows EV signing, package identity, and winget submission

[gchahal1982]

Source PRD rows: docs/prds/agent-studio-open-prd.md:1135, docs/prds/agent-studio-open-prd.md:1187, docs/prds/agent-studio-open-prd.md:1250, docs/prds/agent-studio-open-prd.md:1256, docs/prds/open-studio-platform-prd.md:1734.

Current verified state as of 2026-05-19:

• Agent Studio Open v0.1.0 macOS Apple Silicon DMG is Developer ID signed, notarized, stapled, Gatekeeper-accepted, and attached to GitHub Releases.
• Agent staged x64 winget manifest points at the public MSI and SHA/ProductCode metadata matches release evidence.
• EV Authenticode signing evidence and Microsoft Partner Center identity/publisher evidence are not attached.
• winget submission is not ready until identity and EV evidence exist.

Completion criteria:

• Partner Center identity evidence exists for AuraOne.AgentStudioOpen.
• Public MSI has winget-acceptable EV Authenticode signing evidence.
• winget submission is accepted and winget show AuraOne.AgentStudioOpen resolves.
• Clean Windows install evidence is attached.

Verification commands:

• pnpm --dir opensource/open-studio-platform run verify:windows-package-identity
• pnpm --dir opensource/open-studio-platform run verify:winget-matrix -- --live
• pnpm --dir opensource/open-studio-platform run verify:release-blockers -- --probe-uptime