Switch to .pkg/.exe/.deb installers with Azure Trusted Signing

Replaces the zip-based ci/build.sh flow with installer outputs (Inno Setup
on Windows, productbuild on macOS, cpack DEB on Linux) signed via Microsoft
Trusted Signing on Windows and Apple Developer ID on macOS.

Plugin code: factory wavetables and presets now ship as files via the
installer rather than embedded BinaryData. PluginProcessor implements
getProgramDirectory/getFactoryProgramDirectories so gin scans factory
content from systemResourceRoot. First-run migration copies any presets
from the legacy com.socalabs/Wavetable/programs path into the new user
dir under Library/Audio/Presets/SocaLabs/Wavetable.

Bumps gin submodule to match Identity for getFactoryProgramDirectories
support.

release.sh

@@ -23,4 +23,19 @@ fi
 
 echo "$NOTES" > /tmp/release_notes.txt
 
-gh release create "$VER" --title "$VER" -F /tmp/release_notes.txt ./Binaries\ Linux/*.zip ./Binaries\ Windows/*.zip ./Binaries\ macOS/*.zip
+ASSETS=(
+  "./Binaries Linux"/*.deb
+  "./Binaries Windows"/*.exe
+  "./Binaries macOS"/*.pkg
+)
+if [ -f "./Binaries macOS/Symbols_Mac.zip" ]; then
+  ASSETS+=("./Binaries macOS/Symbols_Mac.zip")
+fi
+
+gh release create "$VER" --title "$VER" -F /tmp/release_notes.txt "${ASSETS[@]}"
+
+for f in "./Binaries Linux"/*.deb \
+         "./Binaries Windows"/*.exe \
+         "./Binaries macOS"/*.pkg; do
+  curl -F "files=@${f}" "https://socalabs.com/files/set.php?key=$APIKEY"
+done