refactor: build via electron-builder's programmatic API instead of the CLI

The wrapper spawned `electron-builder` through `spawnSync(shell: true)`,
which re-tokenizes the command line — so every config value containing a
space (the azureSignOptions publisherName, the appx `CN=` publisher) had to
be manually double-quoted to survive shell splitting, and Node warns about
the unescaped concatenation (DEP0190).

Call the documented `build()` API directly instead. Options are passed as a
structured object that electron-builder deep-merges over
electron-builder.yaml, so there is no shell and no quoting to get wrong.
Target lists go under the platform key (win/mac/linux) rather than as a
`targets` Map, so electron-builder's own option normalization still parses
the `type:arch` suffixes and applies the dir/universal/identity handling
instead of us reimplementing it.

Because the build now runs in-process, CSC stripping removes the vars from
process.env (which electron-builder reads directly) for the duration of the
build and restores them after. Target descriptors hold real arrays instead
of space-joined strings that had to be re-split.

Set `publish: 'never'` explicitly. electron-builder.yaml configures no
publish providers and releases are collected from the build artifacts by
hand, but electron-builder still inferred a publish policy from CI detection
and warned that the implicit behavior will be dropped in a future major.

Author: cwillisf