Unify psign-tool entry point

[mamoreau-devolutions]

Summary

• Add canonical psign-tool with optional --mode auto|windows|portable, defaulting to auto, plus PSIGN_TOOL_MODE support for parity automation.
• Route Windows mode through existing Win32-backed signing/verification paths and portable mode/psign-tool portable ... through the Rust portable SIP/trust runner.
• Refactor psign-digest-cli into a callable library while keeping psign-tool-portable as a transition compatibility binary.
• Rename advertised SIGNTOOL_RS_* usage to PSIGN_*, with legacy fallback for runtime compatibility where needed.
• Update docs, scripts, workflows, tests, Cargo aliases, and CLI matrix references for the unified CLI and new env var names.
• Fix rust SIP parity workflow YAML so dispatch jobs run correctly.

Validation

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --locked --quiet
• cargo test --workspace --locked --quiet
• Unified CLI smoke checks for psign-tool portable ..., PSIGN_TOOL_MODE, and --mode portable verify
• GitHub Actions on pushed HEAD 2902e97:
  • ci-unix: success
  • windows: success
  • rust-sip-parity.yml workflow dispatch: success