package_app.sh assembles and signs CCS Bar.app (menu-bar-only via LSUIElement). Default ad-hoc signing for v1 with documented Gatekeeper guidance; developer-id mode wired for the notarized public-launch path.