Judge deployment commands by exit status on Windows PowerShell

OpenSSL prints normal DSA key notices to stderr. Windows PowerShell treated
those notices as terminating errors under Stop and aborted before signing.
Keep native calls under Continue, then reject nonzero exit codes explicitly.
Use the same invocation helper for installer signing.

Verified on Windows: a native exit 0 with stderr succeeds, exit 7 is rejected,
and the error preference is restored. The full production dry run passed its
format/analyze checks, all 76 tests, the Windows build, Inno Setup packaging,
DSA key matching and installer-signature verification for 1.0.7+10.

docs/production_deploy.md

@@ -169,6 +169,10 @@ for all endpoint, bucket, key, and signing-path overrides.
 
 The script stops on the first failed command.
 
+External commands are judged by their exit codes. Windows PowerShell may display
+normal OpenSSL stderr notices as error records; they do not fail a successful
+command. Key matching and installer-signature verification still must pass.
+
 - Failure before S3 upload leaves production unchanged.
 - Failure after S3 upload but before AppCast publication leaves clients on the
   preceding AppCast. Fix the issue and rerun the same release.

tool/deploy_launcher.ps1

@@ -94,9 +94,19 @@ function Invoke-RequiredCommand {
         [Parameter(Mandatory = $true)][string[]]$Arguments
     )
 
-    & $Command @Arguments
-    if ($LASTEXITCODE -ne 0) {
-        throw "Command failed with exit code ${LASTEXITCODE}: $Command"
+    # Windows PowerShell represents native stderr as error records even on exit 0.
+    # OpenSSL writes its normal key-reading notices there; the exit code is the verdict.
+    $previousPreference = $ErrorActionPreference
+    try {
+        $ErrorActionPreference = 'Continue'
+        & $Command @Arguments
+        $commandExitCode = $LASTEXITCODE
+    }
+    finally {
+        $ErrorActionPreference = $previousPreference
+    }
+    if ($commandExitCode -ne 0) {
+        throw "Command failed with exit code ${commandExitCode}: $Command"
     }
 }
 
@@ -559,12 +569,9 @@ try {
     $previousPath = $env:PATH
     try {
         $env:PATH = "$gitOpenSslDirectory;$env:PATH"
-        $signOutput = & $dart run auto_updater:sign_update `
-            $installerPath `
-            $privateKey 2>&1
-        if ($LASTEXITCODE -ne 0) {
-            throw "Could not sign the installer: $signOutput"
-        }
+        $signOutput = Invoke-RequiredCommand -Command $dart -Arguments @(
+            'run', 'auto_updater:sign_update', $installerPath, $privateKey
+        ) 2>&1
     }
     finally {
         $env:PATH = $previousPath