build: add self-signed local development package

[HelloThisWorld]

Summary

Add a safe local-development build wrapper for producing an installable winTerm 1.0.0 x64 MSIX when no public CA or production signing service is available. Add a 1.0.0 version badge and document the complete build and certificate-trust workflow.

Related issues

No linked issue.

Detailed changes

• add scripts/winterm/build-local-development.ps1;
• run version and Smoke validation before packaging;
• build and validate the Release x64 package, with optional Relevant compiled tests;
• create a one-year non-exportable CN=winTerm Development signing key;
• export only the public .cer, sign without a timestamp, and remove the private key;
• verify package identity, architecture, version, winterm.exe, absence of wt.exe, and the PKCS#7 signature;
• generate INSTALL.txt and verified SHA-256 checksums in an ignored local artifact directory;
• document local self-signed builds in README.md and docs/build.md;
• add a version 1.0.0 badge without changing the blocked Stable-release status.

Validation performed

• scripts/winterm/test.ps1 -Suite Smoke -Configuration Release -Platform x64 — passed.
• Parsed every PowerShell file through the existing Smoke suite — passed.
• Ran the new wrapper end to end against the unsigned x64 MSIX from GitHub Actions run 29626765874 — passed.
• Verified Kaname.winTerm, 1.0.0.0, x64, winterm.exe, and absence of wt.exe — passed.
• Verified the embedded PKCS#7 signature against the exported public certificate — passed.
• Generated and re-verified SHA-256 checksums for the MSIX, certificate, and installation instructions — passed.
• Confirmed generated test output and disposable private certificates were removed.
• git diff --check — passed.

A fresh compile is not available on the local machine because Visual Studio and the full Windows SDK toolchain are absent. The pull-request Windows workflows provide that validation.

Release note

This does not make the self-signed package a Stable installer. Without protected production signing and clean-machine evidence, the existing release workflow may create only a blocked Draft Release after v1.0.0 is deliberately tagged.

Checklist

• The change is focused and does not include unrelated formatting.
• Tests were added or updated where appropriate.
• All tests claimed above actually ran and passed.
• User-facing behavior and limitations are documented in this repository.
• Version or schema changes include compatibility and migration notes.
• Package identity, winterm.exe, and Microsoft Terminal coexistence remain isolated.
• No command text, terminal output, clipboard content, credentials, or private paths are logged.
• New source and script files contain the appropriate MIT license header.
• I did not include generated build output, secrets, certificates, or local absolute paths.