The repo carries two parallel copies of every flow - the top-level
'Windows Dev Config/', 'Workloads/', and 'Wsl Comfort/' directories are
Authenticode-signed release copies, while 'src/...' is the unsigned
source CI runs from. The README's run commands point at the top-level
signed copies; CI and src/docs/development.md point at src/. Nothing in
the top-level README explains the split, so a first-time reader can't
tell which copy is canonical, which to edit, or why a 'src/Windows Dev
Config/' even exists next to a 'Windows Dev Config/'.

Add a 'Repo layout: signed vs source' section to the top-level README
that:

- Lists every path with a one-line description, whether contributors
  should edit it, and whether end users run it.
- States explicitly that the README's run commands point at the signed
  top-level copies on purpose - end users don't need to know src/ exists.
- States explicitly that contributors edit src/, that the top-level
  copies are regenerated by .pipelines/OneBranch.SignAndPackage.yml,
  and that those signed copies were merged from the 'signed' branch in
  PR #6.
- Notes that CI runs the unsigned src/ copies intentionally (signing is
  a release-time, not build-time, concern).
- Calls out three 'don'ts': don't edit a top-level signed copy, don't
  expect the two trees to be byte-identical (signature block aside),
  and don't add a third copy.

Placed between 'Command Palette extension' and 'Troubleshooting' so a
reader who's followed the existing flow descriptions hits it once they
start looking around the repo. Pure documentation change; no code
movement.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>