todo-list-3 version-audit: fix stale 0.3.4 defaults in build-deb.sh and
printit index deb blurb; document audit in PACKAGING; smoke asserts deb
fallback. CDN last-published 0.3.2/0.1.2 checksums left intentional.
Consolidate Authenticode, Apple notary, VM C, and digest-paste into
platform/windows/wix/OPERATOR-READY.md (runbook + commands + secret
names only). Cross-link from CI-SIGN-NOTARY, VM-C-ONE-PAGER, PACKAGING,
and COMMERCIAL-INSTALLER-BACKLOG. Live enable remains blocked only on
org secret store / clean VM — no secret values invented.
Issue 1 software path is complete in-repo (full MSI StageFull, dual-ship-
smoke, sign/notary dry-runs, fill-manifest, CI unsigned + sign example,
PUBLISH-DIGESTS 0.3.6 TBD). Document the offline dry-run commands under
PACKAGING.md Verification so unit/script smoke is discoverable next to the
day-to-day packaging checks. Live Authenticode/notary/VM C remain external.
