Limit the no-resign exemption to the staged helper so LibreOffice's unsigned bundle keeps per-file signing, verify the helper's ticket and Gatekeeper acceptance, stage it after the configuration check only for sources that ship the bundle, and report a missing helper by path. Refs #7514