0e21be21f3
The legacy VSTO project carries <SignManifests>true</SignManifests> with a thumbprint pointing to VS's auto-generated temporary key, which exists on a developer's machine but never on a CI runner. The release manifests are signed properly in publish-clickonce via mage with the real Marcus-Law cert, so /p:SignManifests=false at compile time is the right thing. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>