BUGFIX
Move Windows signing to OIDC and revert two project-scope changes
When you download gh for Windows, the release process now signs code with OIDC instead of a client secret. This changes how the publisher proves its identity during release, not the commands you use. Two changes from the previous release were also reverted: shared handling for project-query scope errors and clearer scope errors while creating project issues. It is like replacing a permanent door key with a short-lived entry pass for each visit, while putting two newly changed signs back until they are ready.