AnyDrag only builds through Xcode, so this repackages the signed and notarized release DMG rather than building from source, keeping the Developer ID signature that Accessibility grants are keyed to. Sparkle update checks are disabled since it cannot replace a bundle living in the Nix store, and analytics are opted out.