Add a codesign verify step on extracted artifacts to catch signature/resource mismatches before upload.