fix: unblock unsigned v1.1.0 release

[HelloThisWorld]

Summary

Unblock the v1.1.0 Release workflow when no trusted Authenticode certificate is configured.

Related issues

No linked issue.

Detailed changes

• Disclose that the v1.1.0 Setup EXE is not code-signed and direct users to SHA256SUMS.txt.
• Automatically append the same disclosure when an unsigned release note source omits it.
• Add a static release-workflow regression boundary for the disclosure behavior.
• Update the README wording from release-candidate notes to release notes while retaining the /releases/latest download link.

Root cause: run 30026095000 successfully built and tested both distributions, but verify-release-assets.ps1 rejected the generated allowlist because docs/releases/1.1.0.md did not disclose the unsigned installer.

Validation performed

• Windows PowerShell 5.1: scripts/winterm/test-release-workflow.ps1 — passed.
• Windows PowerShell 5.1: scripts/winterm/verify-version.ps1 — passed.
• Windows PowerShell 5.1: scripts/winterm/verify-branding.ps1 -ExpectedPublisher 'CN=helloThisWorld' — passed.
• Windows PowerShell 5.1: scripts/winterm/test.ps1 -Suite Smoke -Configuration Release -Platform x64 — passed.
• Generated an unsigned release allowlist from a fixture with no signing statement, then ran verify-release-assets.ps1 — all installer, portable, checksum, metadata, SBOM, and release-note checks passed.
• The failed GitHub run had already passed the x64 Release build, compiled tests, Setup/Portable packaging, and current-user/all-users installer lifecycle tests.

Checklist

• The change is focused and does not include unrelated formatting.
• Tests were added or updated where appropriate.
• All tests claimed above actually ran and passed.
• User-facing behavior and limitations are documented in this repository.
• Version or schema changes include compatibility and migration notes. (No version or schema change.)
• Package identity, winterm.exe, and Microsoft Terminal coexistence remain isolated.
• No command text, terminal output, clipboard content, credentials, or private paths are logged.
• New source and script files contain the appropriate MIT license header. (No new source or script files.)
• I did not include generated build output, secrets, certificates, or local absolute paths.