fix(packaging): make build_macos_signed.sh entitlements check pass

codesign -d --entitlements - now prefixes a text header line, so the
plist parse hit InvalidFileException; --xml emits clean XML (same
workaround as release.yml). Python 3.14's plistlib.load also rejects a
non-seekable pipe, so buffer stdin first.

Without this the script exits before the dmg step after a successful
build and ad-hoc sign.

packaging/build_macos_signed.sh

@@ -121,8 +121,8 @@ else
         -s "$DEVELOPER_ID" "$APP"
 fi
 codesign --verify --deep --strict --verbose=2 "$APP"
-codesign -d --entitlements - "$APP/Contents/PlugIns/DWGThumbnail.appex" \
-    | python3 -c 'import plistlib, sys; assert plistlib.load(sys.stdin.buffer).get("com.apple.security.app-sandbox") is True'
+codesign -d --entitlements - --xml "$APP/Contents/PlugIns/DWGThumbnail.appex" \
+    | python3 -c 'import io, plistlib, sys; assert plistlib.load(io.BytesIO(sys.stdin.buffer.read())).get("com.apple.security.app-sandbox") is True'
 
 echo "==> dmg"
 DMG="$DIST/OpenCADStudio-v$VERSION-macos-arm64.dmg"