Judge deployment commands by exit status on Windows PowerShell

OpenSSL prints normal DSA key notices to stderr. Windows PowerShell treated
those notices as terminating errors under Stop and aborted before signing.
Keep native calls under Continue, then reject nonzero exit codes explicitly.
Use the same invocation helper for installer signing.

Verified on Windows: a native exit 0 with stderr succeeds, exit 7 is rejected,
and the error preference is restored. The full production dry run passed its
format/analyze checks, all 76 tests, the Windows build, Inno Setup packaging,
DSA key matching and installer-signature verification for 1.0.7+10.

docs/production_deploy.md

@@ -169,6 +169,10 @@ for all endpoint, bucket, key, and signing-path overrides.
 
 The script stops on the first failed command.
 
+External commands are judged by their exit codes. Windows PowerShell may display
+normal OpenSSL stderr notices as error records; they do not fail a successful
+command. Key matching and installer-signature verification still must pass.
+
 - Failure before S3 upload leaves production unchanged.
 - Failure after S3 upload but before AppCast publication leaves clients on the
   preceding AppCast. Fix the issue and rerun the same release.