bug 1942364: switch to autograph gcp production for signing

And while I'm in here, remove the `linux` entries that are long unused.

This needs to wait for mozilla-releng/scriptworker-scripts#1123 to be deployed before it can.

taskcluster/ci/repackage-signing/kind.yml

@@ -0,0 +1,37 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+---
+loader: taskgraph.loader.transform:loader
+
+transforms:
+    - taskgraph.transforms.from_deps
+    - mozillavpn_taskgraph.transforms.scriptworker:upstream_artifacts
+    - mozillavpn_taskgraph.transforms.treeherder
+    - mozillavpn_taskgraph.transforms.signing
+    - mozillavpn_taskgraph.transforms.release_index
+    - taskgraph.transforms.task
+
+kind-dependencies:
+    - repackage
+
+tasks:
+    repackage-msi:
+        description: repackage mozillavpn msi
+        run-on-tasks-for: []
+        from-deps:
+            with-attributes:
+                build-type:
+                    - windows/opt
+            group-by:
+                attribute: build-type
+            copy-attributes: true
+        add-index-routes:
+            name: windows
+            type: build
+        signing-format: gcp_prod_autograph_authenticode_202412
+        treeherder:
+            job-symbol: Bs
+            kind: build
+            tier: 1
+            platform: windows/x86_64

taskcluster/ci/signing/kind.yml

@@ -0,0 +1,59 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+---
+loader: taskgraph.loader.transform:loader
+
+transforms:
+    - taskgraph.transforms.from_deps
+    - mozillavpn_taskgraph.transforms.scriptworker:upstream_artifacts
+    - mozillavpn_taskgraph.transforms.treeherder
+    - mozillavpn_taskgraph.transforms.signing
+    - mozillavpn_taskgraph.transforms.release_index
+    - taskgraph.transforms.task
+
+kind-dependencies:
+    - build
+
+tasks:
+    build-signing:
+        description: sign mozillavpn
+        run-on-tasks-for: []
+        from-deps:
+            with-attributes:
+                build-type:
+                    - android-x64/release
+                    - android-x86/release
+                    - android-arm64/release
+                    - android-armv7/release
+                    - macos/opt
+                    - windows/opt
+                    - addons/opt
+            copy-attributes: true
+        add-index-routes:
+            by-build-type:
+                windows/opt: null  # for Windows we want the 'repackage-signing' task
+                default: build
+        signing-format:
+            by-build-type:
+                android.*: gcp_prod_autograph_apk
+                macos.*: macapp
+                windows/opt: gcp_prod_autograph_authenticode_202404
+                addons/opt: gcp_prod_autograph_rsa
+        treeherder:
+            job-symbol:
+                by-build-type:
+                    windows/opt: Bs-internals
+                    default: Bs
+            kind: build
+            tier: 1
+            platform:
+                by-build-type:
+                    android-x64/release: android/x86_64
+                    android-x86/release: android/x86
+                    android-arm64/release: android/arm64-v8a
+                    android-armv7/release: android/armv7
+                    linux/opt: linux/opt
+                    macos/opt: macos/opt
+                    windows/opt: windows/x86_64
+                    addons/opt: addons/opt