Fix sandboxed Sparkle installer configuration

[marcplotkin]

Summary

Fixes the sandboxed Sparkle update path by enabling Sparkle installer launcher support and adding the Mach lookup entitlement entries Sparkle requires for sandboxed apps.

What changed

• Adds SUEnableInstallerLauncherService to the app Info.plist.
• Adds Sparkle installer/status Mach lookup temporary exceptions to the app entitlements.
• Extends the notarization script to fail release builds if the Sparkle sandbox installer configuration is missing.
• Updates README troubleshooting so this failure mode is documented.

Root cause

The app is sandboxed and uses Sparkle 2. Sparkle requires sandboxed apps to opt into the installer launcher service and allow communication with its installer/status helpers. Without that configuration, users can download an update but see An error occurred while launching the installer when installing it.

Validation

• plutil -lint 01_Project/syncthingStatus/Info.plist 01_Project/syncthingStatus/syncthingStatus.entitlements
• /usr/libexec/PlistBuddy -c "Print :SUEnableInstallerLauncherService" 01_Project/syncthingStatus/Info.plist -> true
• Verified entitlements contain $(PRODUCT_BUNDLE_IDENTIFIER)-spks and $(PRODUCT_BUNDLE_IDENTIFIER)-spki
• git diff --check
• bash -n tools/notarize.sh

Full xcodebuild was not run in my oldmac environment because that machine currently has an incompatible Xcode.app (Bad CPU type in executable).