docs: commercial MSI/notary dry-run smoke in PACKAGING verification

Issue 1 software path is complete in-repo (full MSI StageFull, dual-ship-
smoke, sign/notary dry-runs, fill-manifest, CI unsigned + sign example,
PUBLISH-DIGESTS 0.3.6 TBD). Document the offline dry-run commands under
PACKAGING.md Verification so unit/script smoke is discoverable next to the
day-to-day packaging checks. Live Authenticode/notary/VM C remain external.

docs/PACKAGING.md

@@ -268,6 +268,29 @@ go test ./internal/job ./internal/pdfcert ./internal/statuslang -count=1
 Expect: HelperVersion match, no elevated MSI path required, IPP pure on
 tray/menubar assets.
 
+### Commercial MSI / notary dry-runs (Issue 1 software)
+
+Offline helpers — no WiX, signtool, notary credentials, or upload required for
+the tip/print paths. Full inventory and still-left external work:
+[COMMERCIAL-INSTALLER-BACKLOG.md](COMMERCIAL-INSTALLER-BACKLOG.md).
+
+```sh
+# macOS (bash) — exit 0 with tip if notarytool missing; never submits unless NOTARY_SUBMIT=1
+./platform/macos/menubar/notary-dry-run.sh
+
+# Windows (pwsh) — print-only / tip paths exit 0 without WiX or signtool
+powershell -NoProfile -ExecutionPolicy Bypass -File platform/windows/scripts/dual-ship-smoke.ps1
+powershell -NoProfile -ExecutionPolicy Bypass -File platform/windows/scripts/sign-dry-run.ps1
+# Hash a temp file (fill-manifest does not upload):
+powershell -NoProfile -ExecutionPolicy Bypass -File platform/windows/scripts/fill-manifest-sha256.ps1 \
+  -Path .\some-local.msi -AsName VeraePrintStamp-windows-amd64-0.3.6.msi -Format both
+```
+
+CI: unsigned full MSI [`.github/workflows/windows-msi.yml`](../.github/workflows/windows-msi.yml);
+sign example (secret **names** only)
+[`.github/workflows/windows-msi-sign.yml.example`](../.github/workflows/windows-msi-sign.yml.example).
+Digest paste after upload: [PUBLISH-DIGESTS.md](PUBLISH-DIGESTS.md).
+
 ## Related paths
 
 | Path | Notes |