codesign -d --entitlements - now prefixes a text header line, so the
plist parse hit InvalidFileException; --xml emits clean XML (same
workaround as release.yml). Python 3.14's plistlib.load also rejects a
non-seekable pipe, so buffer stdin first.
Without this the script exits before the dmg step after a successful
build and ad-hoc sign.
