Verify current Sparkle item without rejecting feed history

[Augani]

Summary

• select and verify the one appcast item bound to the current release while retaining historical items
• bind the current item title, short version, build, canonical release path, artifact length, and Ed25519 signature to the exact candidate app/update
• reject missing or duplicate current-release identities and mismatched app/update versions
• add historical-feed, duplicate-current, and wrong-build regression cases

Root cause

The release generator correctly retains prior appcast entries, but verify-sparkle-update.sh required the entire feed to contain exactly one item. Every real feed with update history therefore failed after a successful local build.

Verification

• bash -n scripts/verify-sparkle-update.sh scripts/test-verify-sparkle-update.sh
• scripts/test-verify-sparkle-update.sh
• scripts/verify-sparkle-update.sh release-build/export-arm64/Dory.app release-build/Dory-0.4.6-app-update.zip release-build/appcast.xml