docs(packaging/windows): record the driver-signing fingerprint

The stable cert is live and CI is signing with it. Fills in the placeholder in
both docs and adds the one-liner to check an installed driver against it.

Thumbprint 4B8493E7CD565758D335F8F4F05C5A7261A13E02, verified off the .cer a real
windows-host build produced on the runner, not from the key material: RSA 3072,
valid to 2036, extensions 2.5.29.15/37/14 and nothing else. The decisive part is
that the pf-vdisplay and gamepad bundles now carry the SAME thumbprint — the
per-build fallback had each script mint its own 2048-bit cert, so they never
matched. That is what proves the secret reached the build rather than the
fallback quietly running again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packaging/windows/README.md

@@ -153,7 +153,15 @@ Our three UMDF drivers are signed with a **stable self-signed code-signing cert*
 is a **hard failure** (`-RequireSignedCert`, default `auto` off `GITHUB_REF`); canary and local
 builds still fall back to a per-build throwaway.
 
-**Current fingerprint (SHA-1 thumbprint):** `<fill in after generating — see below>`
+**Current fingerprint (SHA-1 thumbprint):** `4B8493E7CD565758D335F8F4F05C5A7261A13E02`
+
+Verify a shipped driver against it:
+
+```powershell
+$dll = Get-ChildItem C:\Windows\System32\DriverStore\FileRepository\pf_vdisplay*\pf_vdisplay.dll |
+         Select-Object -First 1 -Expand FullName
+(Get-AuthenticodeSignature $dll).SignerCertificate.Thumbprint
+```
 
 Why stable matters here. The installer trusts the `.cer` that ships in the bundle
 (`certutil -addstore -f Root` + `TrustedPublisher`, `crates/punktfunk-host/src/windows/install.rs`),