fix(ci): mage -Sign via -CertFile/.pfx (avoid cert store lookup quirks)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -291,11 +291,18 @@ jobs:
               New-Item -ItemType Directory -Force -Path $appFilesDir | Out-Null
               Copy-Item -Recurse -Force "$appBin/*" $appFilesDir
 
+              # Write the PFX to disk so mage can sign via -CertFile (more reliable
+              # than -CertHash under LocalSystem).
+              $signPfx = Join-Path $env:TEMP "sign-$([Guid]::NewGuid()).pfx"
+              [IO.File]::WriteAllBytes($signPfx, [Convert]::FromBase64String($env:PFX_B64))
+
               & "$env:MAGE" -New Application -ToFile "$appFilesDir/MarcusLaw.OutlookAddin.dll.manifest" `
                   -Name "Marcus-Law OutlookAddin" -Version $version -FromDirectory $appFilesDir -TrustLevel FullTrust
-              if ($LASTEXITCODE -ne 0) { throw "mage -New failed" }
+              if ($LASTEXITCODE -ne 0) { throw "mage -New Application failed" }
 
-              & "$env:MAGE" -Sign "$appFilesDir/MarcusLaw.OutlookAddin.dll.manifest" -CertHash $thumb -TimeStampUri http://timestamp.digicert.com
+              & "$env:MAGE" -Sign "$appFilesDir/MarcusLaw.OutlookAddin.dll.manifest" `
+                  -CertFile $signPfx -Password $env:PFX_PWD `
+                  -TimeStampUri http://timestamp.digicert.com
               if ($LASTEXITCODE -ne 0) { throw "mage -Sign app manifest failed" }
 
               # Create the deployment manifest (.vsto) directly via -New Deployment.
@@ -311,8 +318,11 @@ jobs:
                   -Install     true
               if ($LASTEXITCODE -ne 0) { throw "mage -New Deployment failed" }
 
-              & "$env:MAGE" -Sign "$publishDir/OutlookAddin.vsto" -CertHash $thumb -TimeStampUri http://timestamp.digicert.com
+              & "$env:MAGE" -Sign "$publishDir/OutlookAddin.vsto" `
+                  -CertFile $signPfx -Password $env:PFX_PWD `
+                  -TimeStampUri http://timestamp.digicert.com
               if ($LASTEXITCODE -ne 0) { throw "mage -Sign deployment manifest failed" }
+              Remove-Item -Force $signPfx
 
               Get-ChildItem -Recurse -File "$appFilesDir" |
                   ? { $_.Extension -notin '.manifest','.deploy' } |