Summarize MSI dual-ship, CERT-01, and statuslang work for the windows-debug PR. Links OPERATOR-READY and DUAL-SHIP as canonical operator paths; external sign/notary/VM legs stay org-blocked.
