<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Switches Windows packaging to a custom signing hook that signs only
`dyad.exe` using `signtool.exe` bundled with `electron-winstaller`.
> 
> - Replaces `signWithParams` with `windowsSign.hookFunction` in
`forge.config.ts` to run `signtool` via `execSync`
> - Adds `SIGNTOOL_PATH` resolution and imports for `child_process` and
`path`
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
5fa37cca92fecb9bac678b0a1f0f143d4ee7cecb. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
## Summary by cubic
Only sign dyad.exe during the Windows build to avoid signing other files
and prevent CI signing errors. Replaced MakerSquirrel signWithParams
with a windowsSign hook that runs the bundled signtool.exe using the
same cert and timestamp settings.

<sup>Written for commit 5fa37cca92fecb9bac678b0a1f0f143d4ee7cecb.
Summary will update automatically on new commits.</sup>

<!-- End of auto-generated description by cubic. -->