[codex] Wire Azure Trusted Signing for desktop releases

[RhysSullivan]

What changed

• Adds conditional win.azureSignOptions to the desktop Electron builder config.
• Wires Azure Trusted Signing environment variables into the Windows desktop publish leg.
• Adds a Windows-only fail-fast check so release builds do not silently publish unsigned Windows installers when signing config is incomplete.
• Keeps e2e Windows packages explicitly unsigned even if a developer shell has Azure signing env vars set.

Validation

• bun run --filter @executor-js/desktop typecheck
• bun run typecheck
• Imported the builder config with and without signing env vars to verify conditional behavior.
• Parsed .github/workflows/publish-desktop.yml as YAML.

[github-actions]

Cloudflare preview

Console	https://executor-preview-pr-1304.executor-e2e.workers.dev
MCP	https://executor-preview-pr-1304.executor-e2e.workers.dev/mcp
Deployed commit	2e94e5f

Sign-in is Cloudflare Access (one-time PIN to an allowed email). The preview has its own database and encryption key; it is destroyed when this PR closes.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	2e94e5f	Commit Preview URL Branch Preview URL	Jul 04 2026, 05:02 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	2e94e5f	Jul 04 2026, 05:04 AM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1304

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1304

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1304

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1304

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1304

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1304

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1304

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1304

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1304

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1304

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1304

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1304

executor

npm i https://pkg.pr.new/executor@1304

commit: 2e94e5f