ci(999.68): align SignPath slugs to real console (ball/initial) + selectable signing policy (WINSIGN-01)

Actual SignPath slugs (org 'Bioichemical Algorithms Library'): project=ball,
artifact-configuration=initial, test policy=test-signing (VALID test cert),
release policy=release-signing (HSM cert still CSR-pending). Changes:
- project-slug 'ballview' -> 'ball'
- artifact-configuration-slug 'installer' -> 'initial'
- signing-policy-slug -> workflow_dispatch input (default release-signing),
  so a dispatch can pass test-signing to validate the pipeline against the
  test cert now, and tag-triggered releases use release-signing once the HSM
  cert goes VALID.
Runbook updated with the verified slugs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: okohlbacher

.github/workflows/release.yml

@@ -31,6 +31,11 @@ on:
         required: false
         type: boolean
         default: true
+      signing_policy:
+        description: "SignPath signing-policy slug (test-signing to validate the pipeline; release-signing to ship)"
+        required: false
+        type: string
+        default: "release-signing"
   push:
     tags:
       - "v*.*.*"
@@ -1378,9 +1383,9 @@ jobs:
         with:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
           organization-id: ${{ secrets.SIGNPATH_ORG_ID }}
-          project-slug: 'ballview'
-          signing-policy-slug: 'release-signing'
-          artifact-configuration-slug: 'installer'
+          project-slug: 'ball'
+          signing-policy-slug: ${{ inputs.signing_policy || 'release-signing' }}
+          artifact-configuration-slug: 'initial'
           github-artifact-id: ${{ steps.upload-unsigned-installer.outputs.artifact-id }}
           wait-for-completion: true
           output-artifact-directory: 'signed-installer'

.planning/phases/999.68-packaging-signing-license/SIGNPATH-SECRETS-RUNBOOK.md

@@ -66,6 +66,16 @@ signing.
 
 ## 2. Create the project, artifact configuration, and signing policy
 
+> **ACTUAL SLUGS (verified 2026-06-02, org "Bioichemical Algorithms Library"):**
+> project = **`ball`**, artifact-configuration = **`initial`**, test policy =
+> **`test-signing`** (bound to "Test certificate 2026", software keystore, VALID),
+> release policy = **`release-signing`** (bound to "Release certificate 2026", HSM —
+> **CSR PENDING**, not usable until VALID). release.yml is aligned to these:
+> `project-slug: 'ball'`, `artifact-configuration-slug: 'initial'`, and
+> `signing-policy-slug` is a `workflow_dispatch` input defaulting to `release-signing`
+> (pass `test-signing` to validate the pipeline against the test cert). The section
+> below is the original generic guidance.
+
 Once the SignPath organization exists, in the SignPath web console:
 
 1. **Create a project** with slug **`ballview`**.