docs: bank the Windows Store + signing research, and fix the dead EV-certificate line

The distribution answer existed only in conversation, so every session re-derived
it. It is now in the map, and the route decision is explicitly parked as the
creator's.

new TASKS/research-store-certification.md — Store Policies 7.20 + MSIX packaging:
which policies bind, which don't (and why), cert economics, camera/mic gating
layers, YouTube age + COPPA, the 11.12 UGC judgment call.

Two real defects surfaced, neither fixed (docs-only unit):
- FfmpegLocator downloads an unsigned exe from GitHub and runs it. That is
  policy 10.2.2 (dynamic code inclusion) verbatim, and it is the root cause of
  the 2026-09-01 404 — the pin aged out of BtbN's 14-day retention on the
  creator's first real recording attempt. -> TASK 48 item 1, not
  Store-conditional.
- Distribution.md:318 recommended a $400+/yr EV cert for a SmartScreen bypass
  Microsoft removed in March 2024. Fixed; had it shipped it would have cost
  $400+/yr to buy what $150 buys.

Also new: TASKS/task-48 (checklist, carved out of TASK 36 item 6) and
TASKS/task-49 (chat profanity filter, not blocked). ai.md gains the durable
invariants — full trust or recording breaks silently, chat is rendered never
stored — plus a correction to the FFmpeg locator section. MyMistakes.md records
the lesson: a policy citation is a claim about scope, not just text.

MARCOM.md got the privacy-copy guard but is gitignored by design, so that edit
stays local and did not travel here.

Distribution.md

@@ -315,7 +315,36 @@ Single-file means everything is inside the `.exe`. No DLLs, no runtime dependenc
 
 ### 4.3 Code Signing
 
-**Certificate:** Buy an EV (Extended Validation) code-signing certificate from DigiCert or Sectigo ($200-400/year). EV certificates get instant SmartScreen reputation; DV/OV certs trigger SmartScreen warnings for months.
+> ⚠️ **The cert choice below is a live decision, and the old plan's EV recommendation is
+> dead.** Microsoft **removed the SmartScreen instant-bypass for EV certificates in March
+> 2024** — an EV-signed file now accrues reputation exactly like an OV-signed one, so paying
+> $400+/yr buys precisely what paying ~$150 buys. **Do not buy EV.**
+>
+> **But the more interesting finding is that you may not need a certificate at all.** Three
+> costs, current as of 2026-09-27:
+>
+> | Route | Cert/yr | SmartScreen | Note |
+> |---|---|---|---|
+> | **Microsoft Store (MSIX)** | **$0** — Microsoft re-signs | **No warning** | Requires MSIX packaging; Store review; public listing |
+> | **Microsoft Store (EXE/MSI)** | $120–300 — *your* cert | Warning ramp | Store does **not** re-sign; silent install mandatory. Strictly dominated — cert required anyway |
+> | **Direct + OV cert** | $150–300 | Warning ramp | Worldwide availability |
+> | **Direct + Azure Artifact Signing** | ~$9.99/mo ≈ $120 | Warning ramp | **Individuals: USA/Canada only.** Identity validation required |
+>
+> Signing does **not** clear the warning on day one either way: a valid cert stops the
+> *malware* warning immediately, but "unrecognized publisher" clears as SmartScreen accrues
+> reputation from real download volume. Budget cert validity at **460 days** (CA/B Forum
+> CSC-31) — this is a recurring line item, not a one-time purchase — and note that private
+> keys must sit on an **HSM or hardware token**.
+>
+> **The full comparison, the four real combinations, and the policy analysis live in
+> [`TASKS/research-store-certification.md`](TASKS/research-store-certification.md) §2–3.
+> The executable checklist is [`TASKS/task-48-distribution-msix.md`](TASKS/task-48-distribution-msix.md),
+> and the route decision is the creator's.**
+
+**Certificate:** Buy an **OV (Organization Validation)** code-signing certificate from DigiCert
+or Sectigo (~$150–300/year), or an **Azure Artifact Signing** profile (~$9.99/month,
+USA/Canada individuals only) if the geography allows. ⛔ **Not EV** — no SmartScreen benefit
+since March 2024. **Or buy nothing at all** if the route is the Microsoft Store.
 
 **Signing process:**
 ```powershell