Add Windows service, silent auto-update, and code-signing hooks.

Co-authored-by: Cursor <cursoragent@cursor.com>

packaging/publish_release.ps1

@@ -3,7 +3,8 @@ param(
     [switch]$SkipBuild = $false,
     [switch]$SkipInstaller = $false,
     [switch]$SkipGitHub = $false,
-    [switch]$Draft = $false
+    [switch]$Draft = $false,
+    [switch]$Sign = $false
 )
 
 $ErrorActionPreference = "Stop"
@@ -51,6 +52,17 @@ if (-not $SkipInstaller) {
     }
 }
 
+if ($Sign) {
+    $toSign = @()
+    if (Test-Path $setup) { $toSign += $setup }
+    if ($toSign.Count -eq 0) {
+        Write-Host "[WARN] -Sign set but no Setup.exe to sign"
+    } else {
+        Write-Host "==> Signing release artifacts"
+        & powershell -ExecutionPolicy Bypass -File (Join-Path $PSScriptRoot "sign_release.ps1") -Files $toSign
+    }
+}
+
 if ($SkipGitHub) {
     Write-Host "==> Skip GitHub release (-SkipGitHub)"
     exit 0