Enable detached catalog signing for PyManager index files

[zooba]

Also synchronises sign-files.yml with the PyManager repository and streamlines the release/publishing stages to reduce the chances of publishing improperly signed files.

[Copilot]

Pull request overview

This PR updates the Windows release/publishing pipeline to support detached catalog signing for PyManager index JSON files, and refactors signing/publish steps to better align with the PyManager repository and reduce the risk of publishing unsigned artifacts.

Changes:

• Add support for generating and uploading a .cat catalog signature alongside the PyManager index JSON.
• Refactor signing tooling setup via sign-files.yml, including legacy signtool support and improved env handling.
• Adjust publish pipeline wiring to pass signing configuration through to the PyManager publish stage.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 9 comments.

File	Description
windows-release/stage-publish-pymanager.yml	Adds signing configuration/setup and adjusts publish vs. no-upload behavior.
windows-release/sign-files.yml	Extends signing template with legacy tool support and updated file selection logic.
windows-release/merge-and-upload.py	Generates/signs an index catalog (.cat) and uploads it with the index.
windows-release/azure-pipelines.yml	Threads SigningCertificate through to the PyManager publish stage with Unsigned mapped to empty.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.