fix(updater): verify the signer identity, not just the seal, on macOS updates #1588

Problem

MacosSparkleInstaller._verifyCodesign runs codesign --verify --deep --strict on the downloaded bundle. That proves the seal is intact, not who signed it: any validly signed (even ad-hoc) bundle in the zip passes and replaces the installed app.

Expected

Require the new bundle to be signed by the same identity as the running app (compare Team ID / designated requirement via codesign -dv / codesign -R, or spctl --assess --type execute), and refuse otherwise. For unsigned (ad-hoc) installs, fall back to a documented check such as the release checksum.

Notes

The zip comes from GitHub over HTTPS, so exposure needs a compromised release, but this is the check meant to defend against it.