[Marc-André Moreau (mamoreau-devolutions)]

Summary

• Name installers Devolutions.Jiffshot-{architecture}-{version}.msi and show Devolutions Jiffshot in Programs and Features, preserving the existing upgrade identity and install path.
• Sign the executable, Rustolonia host DLL, and MSI using checksum-pinned psign and Azure Trusted Signing with the same secret names as Devolutions/windbg-tool.
• Add a dedicated release workflow that reuses CI packaging, retains Actions artifacts, publishes MSIs/portable ZIPs/checksums, and creates the version tag after successful validation.
• Default release dispatches to a publish-test dry run; production publishing requires master and uses publish-prod.

Validation

• Built the packager and generated x64/ARM64 MSI fixtures; verified filenames and embedded product metadata.
• Linted workflow definitions, parsed embedded PowerShell, and exercised version/branch/tag safeguards, asset assembly, checksums, and publication commands with isolated fixtures/mocks.
• Earlier CI dry run built both architectures and passed x64 tests, then stopped because AZURE_TENANT_ID was unavailable. DevOps has since reported adding it.
• The new release dry run could not be dispatched because release.yml must first exist on the default branch. After merge, run Release with version=0.1.0 and dry_run=true to confirm live signing and release artifact assembly.

No release or version tag has been created.