Limit the no-resign exemption to the staged helper so LibreOffice's
unsigned bundle keeps per-file signing, verify the helper's ticket and
Gatekeeper acceptance, stage it after the configuration check only for
sources that ship the bundle, and report a missing helper by path.
Refs #7514
Build and stage the helper before packaging, keep its bundle unpacked
outside app.asar, verify it instead of re-signing its files, and let the
provider open the unpacked copy.
Refs #7514
yudshj