ci: use newer sign tool for windows

The electron forge one won't support azure trusted account signing

js/forge.config.ts

@@ -7,6 +7,22 @@ import { VitePlugin } from '@electron-forge/plugin-vite';
 import { FusesPlugin } from '@electron-forge/plugin-fuses';
 import { FuseV1Options, FuseVersion } from '@electron/fuses';
 
+// Windows code signing via Azure Trusted Signing. Dormant unless the workflow
+// provisions the dlib + metadata file and exports these env vars, so local
+// `yarn make` and unsigned CI builds both work unchanged.
+const windowsSign = process.env.AZURE_METADATA_JSON_PATH ? {
+  debug: true,
+  signToolPath: process.env.SIGNTOOL_PATH,
+  signWithParams: [
+    '/v',
+    '/fd', 'SHA256',
+    '/tr', 'http://timestamp.acs.microsoft.com',
+    '/td', 'SHA256',
+    '/dlib', process.env.AZURE_DLIB_PATH,
+    '/dmdf', process.env.AZURE_METADATA_JSON_PATH,
+  ].join(' '),
+} : undefined;
+
 const config: ForgeConfig = {
   packagerConfig: {
     asar: true,
@@ -22,7 +38,8 @@ const config: ForgeConfig = {
     osxSign: {},
     osxNotarize: {
       keychainProfile: 'default',
-    }
+    },
+    windowsSign
   },
   publishers: [
     {
@@ -42,20 +59,7 @@ const config: ForgeConfig = {
   makers: [
     new MakerSquirrel((arch) => ({
       remoteReleases: `https://storage.googleapis.com/flowy-releases/llink/win32/${arch}`,
-      // Windows code signing via Azure Trusted Signing. Dormant unless the workflow
-      // provisions the dlib + metadata file and exports these env vars, so local
-      // `yarn make` and unsigned CI builds both work unchanged.
-      windowsSign: process.env.AZURE_METADATA_JSON_PATH ? {
-        debug: true,
-        signWithParams: [
-          '/v',
-          '/fd', 'SHA256',
-          '/tr', 'http://timestamp.acs.microsoft.com',
-          '/td', 'SHA256',
-          '/dlib', process.env.AZURE_DLIB_PATH,
-          '/dmdf', process.env.AZURE_METADATA_JSON_PATH,
-        ].join(' '),
-      } : undefined,
+      windowsSign
     })),
     new MakerZIP((arch) => ({
       macUpdateManifestBaseUrl: `https://storage.googleapis.com/flowy-releases/llink/darwin/${arch}`