Fix Windows shortcut updates and sign .node artifacts

- use `replace` when writing Windows mpv shortcuts and update tests
- include `*.node` files in SignPath Authenticode signing config
- document WinShell plugin sourcing in installer/build notes

build/installer.nsh

@@ -125,6 +125,8 @@ FunctionEnd
       CreateDirectory "$SMPROGRAMS\${MENU_FILENAME}"
     !endif
     CreateShortCut "$WindowsMpvShortcutStartMenuPath" "$appExe" "--launch-mpv" "$appExe" 0 "" "" "Launch mpv with the SubMiner profile"
+    # electron-builder's upstream NSIS templates use the same WinShell call for AppUserModelID wiring.
+    # WinShell.dll comes from electron-builder's cached nsis-resources bundle, so bun run build:win needs no extra repo-local setup.
     ClearErrors
     WinShell::SetLnkAUMI "$WindowsMpvShortcutStartMenuPath" "${APP_ID}"
   ${else}
@@ -133,6 +135,7 @@ FunctionEnd
 
   ${if} $WindowsMpvShortcutDesktopEnabled == "1"
     CreateShortCut "$WindowsMpvShortcutDesktopPath" "$appExe" "--launch-mpv" "$appExe" 0 "" "" "Launch mpv with the SubMiner profile"
+    # ClearErrors keeps the optional AUMI assignment non-fatal if the packaging environment is missing WinShell.
     ClearErrors
     WinShell::SetLnkAUMI "$WindowsMpvShortcutDesktopPath" "${APP_ID}"
   ${else}

build/signpath-windows-artifact-config.xml

@@ -12,6 +12,9 @@
         <pe-file path="*.dll" max-matches="unbounded">
           <authenticode-sign />
         </pe-file>
+        <pe-file path="*.node" max-matches="unbounded">
+          <authenticode-sign />
+        </pe-file>
       </directory>
     </zip-file>
   </zip-file>