Two changes:
1. New top-level "Verify vendored helper" step right after the version
   bump, so a stale vendor/ aborts the workflow before any build runs.
2. Inside the "Build Sparkle update archive" step, call
   embed_vendored_helper.sh between cp and sign_app.sh — the same
   sequence build_dmg.sh now uses.

Result: KeyStats.zip (the Sparkle update artifact) ships a helper
whose cdhash equals vendor/KeyStatsHelper.cdhash.txt, so updating
across releases (without re-vendoring) preserves users' TCC grant.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>