v0.65.2 — Release pipeline fix (continued)

Patch release of v0.65.1. All v0.65.0 functional changes apply — see v0.65.0 release notes for the SR-001..SR-024 security-hardening details and pre-deploy checklist.

What changed since v0.65.1

• fix(release): skip .pkg/.zip files in macOS binary verify loop (#599). Follow-up to #598 — the verify loop's prefix glob also matched .pkg files at verify time, and codesign returned "not signed" for productsigned .pkgs. Skipping non-binary files in the binary loop; the dedicated .pkg loop continues to verify installer signatures via pkgutil --check-signature, xcrun stapler validate, and spctl -a -t install.

Full Changelog: v0.65.1...v0.65.2