ci(release): ship the update archive as tar.xz

[datlechin]

Stacked on #3362.

Why

The Sparkle update archive is a deflate zip. As tar.xz, the 0.80.0 app is 21.2 MB instead of 33.9 MB on arm64 and 24.5 MB instead of 36.4 MB on x86_64, and every shipped build can install it.

Change

• package-artifacts.sh writes TablePro-<arch>.tar.xz with /usr/bin/tar (symlinks kept, no extended attributes, xz level 9) instead of the ditto zip. The DMG and plugin zips stay.
• New build step, verify-update-archive.sh: extracts the archive with the command Sparkle runs (/usr/bin/tar -zxC), then runs codesign --verify --deep --strict, stapler validate and spctl -a -t exec on the app.
• The release job, sign-and-appcast.sh and the upload use the tar.xz. fetch-delta-bases.sh takes whichever archive an earlier release has, so the first deltas still come from zips.

Verified

• Every Sparkle a release tag pins in Package.resolved: 2.8.1 (v0.1.1 to v0.15.0), 2.9.0 (v0.16.0 to v0.63.0), 2.9.5 (v0.64.0 to v0.74.0), 2.10.0 (v0.75.0 to v0.80.0); v0.1.0 has no Sparkle. In each, SUPipedUnarchiver maps .tar.xz to /usr/bin/tar -zxC, AppInstaller keeps the whole .tar.xz suffix, and testUnarchivingTarDotXz covers it. GitHub sends filename=<asset>.tar.xz, which Sparkle names the download from.
• package-artifacts.sh on the published 0.80.0 arm64 app: 21,188,832 bytes, and the new step passes it. It fails a tampered file and a tar that follows symlinks.
• Dry run of sign-and-appcast.sh with tar.xz archives and zip delta bases: tar.xz enclosures, release notes paired, deltas built. Nothing uploaded.

Not in this PR

• The first release run proves it on notarized CI output. Extraction takes 0.9 s of CPU on Apple silicon (0.1 s for the zip); Intel is unmeasured.