Limit the no-resign exemption to the staged helper so LibreOffice's
unsigned bundle keeps per-file signing, verify the helper's ticket and
Gatekeeper acceptance, stage it after the configuration check only for
sources that ship the bundle, and report a missing helper by path.
Refs #7514