Correct the SignPath comments for action v3

[erikdarlingdata]

Summary

• The v1.27.0 Release run did not sign (v1.27.0 release did not sign after the SignPath action moved to v3 #569). Action v3 sends signing requests to SignPath's new Pipeline Connector. The Pipeline Connector needs the SignPath GitHub App on the repository, and the app is now installed.
• Some comments in release.yml and in the SignPath policy file were out of date. They described the release flow from before gh release create moved after signing. They also did not mention the app requirement or the limit of 3 attempts for each run.
• This PR changes comments only. No step, input, or policy rule changes.

Changes

• .github/workflows/release.yml: Add a note above the "Sign Windows build" step. The note says that v3 needs the SignPath GitHub App, and that SignPath signs only the first 3 attempts of a run. Correct the timeout comment, because a failed signing no longer leaves a published release.
• .signpath/policies/PerformanceStudio/release-signing.yml: Add a note from the SignPath changelog (Pipeline Connector 0.8.0, 2026-09-09). The Pipeline Connector reads this file only when the signing policy references it as a Pipeline Policy. Correct the reason for leaving out build.disallow_reruns, because the release is now created after signing. Correct the reason for leaving out branch_rulesets, because main now has the "Protect main" ruleset.

Test Plan

• Both files parse as YAML.
• git diff changes comment lines only.
• The next Release run, from a new dev to main merge, signs with v3.

Part of #569.

Generated with Claude Code

https://claude.ai/code/session_011ujjGZ64tzhVqkEBfaxe4o

[claude]

Reviewed. This is a comment-only change to .github/workflows/release.yml and .signpath/policies/PerformanceStudio/release-signing.yml — no steps, inputs, or policy rules change, and no application/T-SQL code is touched, so the usual PerformanceStudio review criteria (plan-XML handling, generated T-SQL, PlanViewer.Ssms version sync, etc.) don't apply here.

Spot-checked the factual claims in the new comments against the current repo state:

• gh release create (release.yml:165-171) does run after the "Sign Windows build" step (release.yml:138), confirming the updated claim that a failed signing no longer leaves a published release.
• The "Protect main" ruleset does exist on main (verified via gh api repos/.../rulesets), confirming the corrected branch_rulesets comment.
• The v3 action / Pipeline Connector / GitHub App claims aren't independently verifiable from this repo, but are consistent with the stated motivation (v1.27.0 release did not sign after the SignPath action moved to v3 #569) and read as accurate.

No correctness, security, or convention issues found. LGTM.