Add forge pipeline polish, simple forge UX, and fleet management upgrades.

Fusion copies prep icon and version info via go-winres; optional Garble obfuscation, Authenticode signing, and dry-run size estimates. Forge Simple mode with smart defaults; fleet roster gets compact expandable cards, filters, bulk commands, per-agent notes/tags, and typed WebSocket payloads.

server/internal/builder/sign_windows.go

@@ -0,0 +1,79 @@
+//go:build windows
+
+package builder
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+func (h *Handler) shouldSignBuild(req *BuildRequest) bool {
+	if !h.policy.Sign.Enabled || strings.TrimSpace(h.policy.Sign.CertThumbprint) == "" {
+		return false
+	}
+	return req.SignBuild
+}
+
+func (h *Handler) signExecutable(path string) error {
+	policy := h.policy.Sign
+	tool := strings.TrimSpace(policy.ToolPath)
+	if tool == "" {
+		var err error
+		tool, err = findSignTool()
+		if err != nil {
+			return err
+		}
+	}
+
+	tsURL := strings.TrimSpace(policy.TimestampURL)
+	if tsURL == "" {
+		tsURL = "http://timestamp.digicert.com"
+	}
+
+	args := []string{
+		"sign",
+		"/fd", "SHA256",
+		"/tr", tsURL,
+		"/td", "SHA256",
+		"/sha1", strings.TrimSpace(policy.CertThumbprint),
+		path,
+	}
+	cmd := exec.Command(tool, args...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("signtool: %w (%s)", err, strings.TrimSpace(string(out)))
+	}
+	log.Printf("[Forge] Signed %s", filepath.Base(path))
+	return nil
+}
+
+func findSignTool() (string, error) {
+	if p, err := exec.LookPath("signtool"); err == nil {
+		return p, nil
+	}
+	if p, err := exec.LookPath("signtool.exe"); err == nil {
+		return p, nil
+	}
+
+	roots := []string{
+		os.Getenv("ProgramFiles(x86)"),
+		os.Getenv("ProgramFiles"),
+	}
+	for _, root := range roots {
+		if root == "" {
+			continue
+		}
+		kits := filepath.Join(root, "Windows Kits", "10", "bin")
+		matches, _ := filepath.Glob(filepath.Join(kits, "*", "x64", "signtool.exe"))
+		for i := len(matches) - 1; i >= 0; i-- {
+			if _, err := os.Stat(matches[i]); err == nil {
+				return matches[i], nil
+			}
+		}
+	}
+	return "", fmt.Errorf("signtool.exe not found — install Windows SDK or set sign_tool_path in Calibrate")
+}