Compile Sigstore trust bootstrap into AppUpdater

[mxcl]

Summary

• compile the existing TUF root and trusted-root snapshot directly into AppUpdater
• remove the production SwiftPM resource bundle dependency
• make the live attestation smoke test run after its build directory is moved away

Root cause

Bundle.module relied on SwiftPM's generated resource accessor. The manually assembled macOS smoke app copied the bundle into Contents/Resources, but the accessor searched beside the app bundle and then fell back to the original build directory. That fallback made the smoke test pass while a relocated release app crashed loading the trust bootstrap.

Security impact

The compiled trust bootstrap is byte-for-byte identical to AppUpdater 4.1.0's resources. TUF rotation, metadata verification, and the existing offline fallback policy are unchanged; this only removes the runtime packaging dependency.

Checks

• swift test — 75 tests passed
• release build contains no AppUpdater_AppUpdater.bundle
• compiled trust bootstrap bytes match the 4.1.0 resources
• live signed relocation smoke: incorrect source ref rejected; attested Automic-Vault-2.10.0.dmg prepared successfully with .build absent