ci(release): parse codesign entitlements as xml on newer runners

codesign -d --entitlements - on current macOS runner images prefixes the
plist with text headers, so the sandbox entitlement assertion died with
plistlib InvalidFileException and took the .dmg build down with it.
--xml prints the bare plist on both old and new codesign builds.

.github/workflows/release.yml

@@ -492,8 +492,10 @@ jobs:
             OpenCADStudio.app/Contents/PlugIns/DWGThumbnail.appex
           codesign --force --sign - --timestamp=none OpenCADStudio.app
           codesign --verify --deep --strict --verbose=2 OpenCADStudio.app
-          codesign -d --entitlements - OpenCADStudio.app/Contents/PlugIns/DWGThumbnail.appex \
-            | python3 -c 'import plistlib, sys; assert plistlib.load(sys.stdin.buffer).get("com.apple.security.app-sandbox") is True'
+          # --xml keeps newer codesign builds from prefixing text headers,
+          # which made the entitlements parse fail with InvalidFileException.
+          codesign -d --entitlements - --xml OpenCADStudio.app/Contents/PlugIns/DWGThumbnail.appex \
+            | python3 -c 'import io, plistlib, sys; ent = plistlib.load(io.BytesIO(sys.stdin.buffer.read())); print("entitlements:", ent); assert ent.get("com.apple.security.app-sandbox") is True'
 
       - name: Create .dmg
         run: |