fix(windows): resolve crash-on-launch and signing pipeline issues

- fix(media_keys): extract real HWND from Tauri main window for souvlaki
  SMTC registration; souvlaki panics (not errors) on Windows when hwnd is
  None, causing a 0xC0000409 FAST_FAIL_FATAL_APP_EXIT crash at startup
- fix(build): replace ConvertTo-SecureString with .NET SecureString loop
  to avoid dependency on Microsoft.PowerShell.Security auto-loading
- fix(build): set signCommand as {cmd, args} object with cmd /C wrapper;
  .cmd batch files cannot be launched directly via CreateProcess, and the
  object form is required to place %1 in args for Tauri path substitution
- docs(builds): document scripts/build.ps1 local Windows build workflow

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: pythoninthegrass

Cargo.lock

@@ -79,6 +79,11 @@ default = ["mcp"]
 devtools = ["dep:tauri-plugin-devtools", "tauri/devtools"]
 mcp = ["dep:tauri-plugin-mcp-bridge"]
 
+[target.'cfg(target_os = "windows")'.dependencies]
+# Required to extract the HWND from the Tauri window for souvlaki SMTC registration.
+# souvlaki panics on Windows if PlatformConfig.hwnd is None.
+raw-window-handle = "0.6"
+
 [target.'cfg(target_os = "macos")'.dependencies]
 objc2 = "0.6"
 objc2-app-kit = { version = "0.3", features = ["NSOpenPanel", "NSSavePanel", "NSApplication", "NSRunningApplication"] }