fix: make packaged updates certificate-free

docs/PRODUCTION_READINESS_1.0.md

@@ -58,22 +58,21 @@ container, repository, environment, commit parity and health distinctly. Dense
 inventories, long names, keyboard focus, dialogs, reduced motion and high scaling
 are part of the automated matrix.
 
-## 9. Packaging, updating and signing
+## 9. Packaging and updating
 
 Windows installer and portable packaging use deterministic names; old `dist`
 versions are pruned after every successful build. Publication stays draft until
 installer, portable, checksums, provenance and CycloneDX SBOM are complete. Binary
-updates verify checksum, exact publisher and timestamp. A disposable local
-Authenticode fixture proves installer, portable, helper and uninstaller signing,
-RFC 3161 timestamping, publisher pinning and tamper rejection.
+updates verify the exact release asset, executable format and published SHA-256
+before download staging and again before replacement. Authenticode is optional and
+is not a release or updater dependency for this personal/internal application.
 
 ## 10. Release decision
 
 No open P0 or P1 technical issue is known after the final quality, browser,
 acceptance, signing and packaging gates. The technically correct status is:
 
-`TECHNICALLY_COMPLETE_PENDING_EXTERNAL_REQUIREMENTS`
+`TECHNICALLY_COMPLETE`
 
-The sole external production dependency is:
-
-`PENDING_HUMAN_INPUT: trusted production Authenticode certificate and exact legal publisher subject`
+There is no paid certificate or external signing-service dependency. Windows may
+show its normal unknown-publisher warning during first installation.