Say the SignPath policy file is not enforced

[erikdarlingdata]

Summary

• SignPath's Pipeline Connector, which action v3 uses, reads .signpath/policies/* files only when the signing policy references them as a pipeline policy. This SignPath organization is on the OSS subscription, and its dashboard has no pipeline policy setting (checked 2026-09-25). For that reason, SignPath does not check the rule in release-signing.yml.
• The comment from Correct the SignPath comments for action v3 #570 told readers to add the reference in the SignPath dashboard. That is not possible, so this PR says that SignPath does not enforce the file, and it names the checks that do apply.
• This PR changes comments only.

Changes

• .signpath/policies/PerformanceStudio/release-signing.yml: Replace the header comment. It now says that SignPath does not enforce the file and gives the reason. It also names the checks on the signing policy that do apply: trusted build system, origin verification, and allowed branch names.

Test Plan

• The file parses as YAML.
• git diff changes comment lines only.

Part of #569.

Generated with Claude Code

https://claude.ai/code/session_011ujjGZ64tzhVqkEBfaxe4o

[claude]

Reviewed. This is a comment-only change to .signpath/policies/PerformanceStudio/release-signing.yml — no code, T-SQL, version, or linked-file changes are in scope for the repo conventions checklist. The updated comment is internally consistent with the rest of the file (the "Deliberately omitted" section still correctly reflects that runners.require_github_hosted is the only field SignPath currently enforces here). I can't independently verify the claim about the SignPath OSS dashboard lacking a Pipeline Policy setting, but nothing in the diff is contradictory or risky. No findings.