chore: migrate Windows binary signing to Google Cloud KMS (HSM) (perc…

…y#2168)

Replace lando/code-sign-action (PFX-based) with signtool + Google Cloud
KMS CNG Provider for HSM-backed code signing. The private key never
leaves the HSM.

Changes:
- Install CNG Provider on Windows runner at build time
- Decode base64-encoded GCP SA key and certificate from secrets
- Sign with signtool.exe using CNG Provider and KMS key
- Add temporary test workflow for validation (test-win-signing.yml)

Secrets required: GCP_WIN_CODESIGN_SA_KEY_B64, WIN_CODESIGN_CERT_CHAIN_B64, GCP_KMS_KEY_PATH
Secrets to remove after migration: WINDOWS_CERT, WINDOWS_CERT_KEY

See PER-7308.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

version bump (percy#2163)

chore: update package versions to 1.31.11-beta.0 across all packages (p…

…ercy#2159)

* chore: update package versions to 1.31.11-beta.0 across all packages

* chore: change publishConfig tag from latest to beta for all packages

🔖 Release 1.31.10 (percy#2156)

* 🔖 Release 1.31.10

* updating tag

🔖 Release 1.31.10-beta.3 (percy#2155)

chore: update package versions to 1.31.10-beta.2 (percy#2152)

🔖 Release 1.31.10-beta.1 (percy#2142)

* version bump

* updating percy-doctor version

---------

Co-authored-by: rishigupta1599 <rishi@browserstack.com>

release-1.31.10-beta.0 (percy#2136)

🔖 Release 1.31.9 (percy#2116)

Bump version to 1.31.9-beta.5 (percy#2114)