Switch to .pkg/.exe/.deb installers with Azure Trusted Signing

Replaces the zip-based ci/build.sh flow with installer outputs (Inno Setup
on Windows, productbuild on macOS, cpack DEB on Linux) signed via Microsoft
Trusted Signing on Windows and Apple Developer ID on macOS.

Plugin code: factory wavetables and presets now ship as files via the
installer rather than embedded BinaryData. PluginProcessor implements
getProgramDirectory/getFactoryProgramDirectories so gin scans factory
content from systemResourceRoot. First-run migration copies any presets
from the legacy com.socalabs/Wavetable/programs path into the new user
dir under Library/Audio/Presets/SocaLabs/Wavetable.

Bumps gin submodule to match Identity for getFactoryProgramDirectories
support.

.gitignore

@@ -33,6 +33,8 @@
 xcuserdata
 Builds
 JuceLibraryCode
-ci/bin
+bin
+Installer/macOS/bin
+Installer/win/bin
 .DS_Store
 .claude