Align prerelease dry-run signing requirements

Keep macOS notarization mandatory for every release candidate while requiring Windows Authenticode only for stable promotion, matching the publish workflow and RC4 release packet.

.github/workflows/release-dry-run.yml

@@ -69,7 +69,7 @@ jobs:
     with:
       version: ${{ inputs.version }}
       require_macos_signing: true
-      require_windows_signing: true
+      require_windows_signing: ${{ !contains(inputs.version, '-') }}
 
   dry-run:
     name: Preflight Release Checks (No Publish)

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -376,9 +376,15 @@ TLS floor in the dynamic config.
    to per-entry archive streaming.
    A manually dispatched release rehearsal must activate the same signed
    candidate build whenever its required `version` input is non-empty and must
-   require the same macOS notarization and Windows Authenticode lanes as a
-   publish run. A cheap signing-configuration job must report every missing
-   repository secret before either platform runner is allocated.
+   apply the same channel-specific native-signing policy as a publish run.
+   macOS notarization remains mandatory for both prerelease and stable
+   candidates. Windows Authenticode remains mandatory for stable candidates;
+   prerelease candidates may retain checksum and detached-signature
+   verification without Authenticode while the release packet explicitly
+   discloses the unknown-publisher warning and stable promotion remains
+   blocked. A cheap signing-configuration job must report every missing secret
+   for the platforms required by that candidate before either platform runner
+   is allocated.
    macOS command-line agent notarization must fail closed unless
    `notarytool --wait --output-format json` reports `Accepted`, then verify the
    exact candidate bytes with strict `codesign`. Bare Mach-O command-line

scripts/release_control/release_promotion_policy_test.py

@@ -487,7 +487,7 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
         self.assertIn("build_release_candidate:", workflow)
         self.assertIn("if: ${{ inputs.version != '' }}", workflow)
         self.assertIn("require_macos_signing: true", workflow)
-        self.assertIn("require_windows_signing: true", workflow)
+        self.assertIn("require_windows_signing: ${{ !contains(inputs.version, '-') }}", workflow)
         self.assertNotIn("if: ${{ github.event_name == 'workflow_dispatch' }}", workflow)
         self.assertIn("record_rc_to_ga_rehearsal.py --run-id ${{ github.run_id }}", workflow)
         self.assertIn("rc-to-ga-promotion-readiness-rehearsal-<record-date>.md", workflow)