Sign the uninstaller in Windows release installers

scripts/restore-from-signpath.ps1

@@ -1,7 +1,8 @@
 # Copies the files SignPath signed back over the originals in the portable bundle they
 # were staged from with stage-for-signpath.ps1 -Bundle: the root of the signed artifact
 # holds OrcaSlicer's own binaries, third-party/ the other files under their paths in the
-# bundle.
+# bundle. Root files named in -Exclude came from outside the bundle, such as the exported
+# uninstaller, and stay in -SignedDirectory.
 [CmdletBinding()]
 param(
     [Parameter(Mandatory = $true)]
@@ -10,14 +11,17 @@ param(
 
     [Parameter(Mandatory = $true)]
     [ValidateScript({ Test-Path -LiteralPath $_ -PathType Container })]
-    [string]$Bundle
+    [string]$Bundle,
+
+    [string[]]$Exclude = @()
 )
 
 $ErrorActionPreference = "Stop"
 
 $signedRoot = (Resolve-Path -LiteralPath $SignedDirectory).Path.TrimEnd('\', '/')
 $thirdPartyPrefix = "third-party" + [IO.Path]::DirectorySeparatorChar
-$files = Get-ChildItem -LiteralPath $signedRoot -Recurse -File
+$files = Get-ChildItem -LiteralPath $signedRoot -Recurse -File |
+    Where-Object { $_.DirectoryName -ne $signedRoot -or $_.Name -notin $Exclude }
 if (-not $files) {
     throw "No signed files found in '$signedRoot'."
 }
@@ -37,4 +41,4 @@ foreach ($file in $files) {
     Copy-Item -LiteralPath $file.FullName -Destination $target -Force
 }
 
-Write-Host "Restored $($files.Count) signed files into '$Bundle'."
+Write-Host "Restored $(@($files).Count) signed files into '$Bundle'."

scripts/stage-for-signpath.ps1

@@ -7,14 +7,16 @@
 # -Path stages the given files at the root of -Destination.
 #
 # -Bundle stages a portable OrcaSlicer bundle for signpath/windows-binaries-v1.xml:
-# OrcaSlicer's own binaries (-OwnBinaries) at the root, where their version information
-# is checked, and every other executable, DLL and Python extension module that carries no
+# OrcaSlicer's own binaries (-OwnBinaries, plus any -Path files from outside the bundle,
+# such as the exported uninstaller) at the root, where their version information is
+# checked, and every other executable, DLL and Python extension module that carries no
 # signature under third-party/, at its path in the bundle. Files signed by their vendor,
 # such as the Microsoft runtime, keep that signature. restore-from-signpath.ps1 copies the
 # signed files back.
 [CmdletBinding(DefaultParameterSetName = "Path")]
 param(
     [Parameter(Mandatory = $true, ParameterSetName = "Path")]
+    [Parameter(ParameterSetName = "Bundle")]
     [string[]]$Path,
 
     [Parameter(Mandatory = $true, ParameterSetName = "Bundle")]
@@ -50,21 +52,20 @@ function Test-VersionInfo {
 
 New-Item -ItemType Directory -Force -Path $Destination | Out-Null
 
-if ($PSCmdlet.ParameterSetName -eq "Path") {
-    foreach ($file in $Path) {
-        Test-VersionInfo $file
-        Copy-Item -LiteralPath $file -Destination $Destination -Force
-        Write-Host "Staged $(Split-Path -Leaf $file) ($ProductName $ProductVersion)"
-    }
-    exit 0
+$ownFiles = @($Path | Where-Object { $_ })
+if ($PSCmdlet.ParameterSetName -eq "Bundle") {
+    $bundleRoot = (Resolve-Path -LiteralPath $Bundle).Path.TrimEnd('\', '/')
+    $ownFiles = @($OwnBinaries | ForEach-Object { Join-Path $bundleRoot $_ }) + $ownFiles
 }
 
-$bundleRoot = (Resolve-Path -LiteralPath $Bundle).Path.TrimEnd('\', '/')
-foreach ($name in $OwnBinaries) {
-    $file = Join-Path $bundleRoot $name
+foreach ($file in $ownFiles) {
     Test-VersionInfo $file
     Copy-Item -LiteralPath $file -Destination $Destination -Force
-    Write-Host "Staged $name ($ProductName $ProductVersion)"
+    Write-Host "Staged $(Split-Path -Leaf $file) ($ProductName $ProductVersion)"
+}
+
+if ($PSCmdlet.ParameterSetName -eq "Path") {
+    exit 0
 }
 
 $thirdParty = Get-ChildItem -LiteralPath $bundleRoot -Recurse -File |