The choco community feed can return transient 503s (as it did on the first
run), which left gpg.exe missing and failed the step. Install Gpg4win via a
feed-independent direct download first, then winget, then choco with retries;
succeed if any strategy yields gpg.exe.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
convertToUnixPath() rewrites drive letters to MSYS form (R:\ -> /r/),
which native GnuPG (Gpg4win) cannot resolve. Add investigation.md and a
windows-latest reproducer workflow that installs native GnuPG and expects
the action to fail at GPG signature verification.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Alban Auzeill
