Sparkle ships Autoupdate, Updater.app and its two XPC services ad-hoc
signed, and Xcode leaves them that way. Apple's notary service rejected
the first 1.0.0 submission for exactly those four binaries. build.sh
now re-signs them with the Developer ID, innermost first, and re-seals
the framework and the app, without --deep so the helper and the Control
Center extension keep their own entitlements.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>