Add explicit Authenticode workflows and correct CI helper contracts

NOTES.md

@@ -1,5 +1,10 @@
 # CI APIs
 
+These historical availability notes are unverified. The analyzed ci.dll
+10.0.26100.8328 x64 still exports the digest-based APIs listed below. Exact
+first-available builds and ABI changes need matching old binaries. See
+[the current contracts and remaining work](docs/mincrypt-contracts.md).
+
 ## Available starting with 1511
 
 - CiCheckSignedFile