release.yml invokes scripts/generate-macos-appcast.sh directly, but the
file was added in #2701 without the executable bit, so the release
workflow fails at "Generate signed Sparkle appcast" with
"Permission denied" (run #33306002525).