[Bug]: Signed installer packages fail pkgutil/spctl signature validation on macOS 15.5

# Signed installer packages fail pkgutil/spctl signature validation on macOS 15.5

Issue type: Bug

## Summary

The release assets named as signed installer packages fail local package signature validation on my Mac, even though the downloaded bytes match the SHA-256 digests published by the GitHub release metadata.

I stopped the install because macOS reports the package signature as invalid/absent.

## Environment

- Hardware: Apple silicon (`arm64`)
- macOS: 15.5 (`24F74`)
- `container` was not previously installed on `PATH`

## Release assets checked

### `1.0.0`

Asset: `container-1.0.0-installer-signed.pkg`

GitHub release metadata digest:

```text
sha256:13f45f26da94c354adcbefe1e8f7631e7f126e93c5d4dd6a5a538aa66b4f479d
```

Local checksum matches:

```sh
shasum -a 256 /private/tmp/apple-container-install/container-1.0.0-installer-signed.pkg
```

```text
13f45f26da94c354adcbefe1e8f7631e7f126e93c5d4dd6a5a538aa66b4f479d /private/tmp/apple-container-install/container-1.0.0-installer-signed.pkg
```

Signature checks fail:

```sh
pkgutil --check-signature /private/tmp/apple-container-install/container-1.0.0-installer-signed.pkg
```

```text
Package "container-1.0.0-installer-signed.pkg":
Status: invalid signature
```

```sh
spctl -a -vv -t install /private/tmp/apple-container-install/container-1.0.0-installer-signed.pkg
```

```text
/private/tmp/apple-container-install/container-1.0.0-installer-signed.pkg: internal error in Code Signing subsystem
```

`xar` does not show signature-related entries:

```sh
xar -tf /private/tmp/apple-container-install/container-1.0.0-installer-signed.pkg
```

```text
Bom
Payload
PackageInfo
```

### `0.12.3`

Asset: `container-0.12.3-installer-signed.pkg`

GitHub release metadata digest:

```text
sha256:83f363126ac1f064588de39cd6b474340d489c1926492a2c4e59c4d54aa6d8e3
```

Local checksum matches:

```sh
shasum -a 256 /private/tmp/apple-container-install-0.12.3/container-0.12.3-installer-signed.pkg
```

```text
83f363126ac1f064588de39cd6b474340d489c1926492a2c4e59c4d54aa6d8e3 /private/tmp/apple-container-install-0.12.3/container-0.12.3-installer-signed.pkg
```

Signature checks fail similarly:

```sh
pkgutil --check-signature /private/tmp/apple-container-install-0.12.3/container-0.12.3-installer-signed.pkg
```

```text
Package "container-0.12.3-installer-signed.pkg":
Status: invalid signature
```

```sh
spctl -a -vv -t install /private/tmp/apple-container-install-0.12.3/container-0.12.3-installer-signed.pkg
```

```text
/private/tmp/apple-container-install-0.12.3/container-0.12.3-installer-signed.pkg: internal error in Code Signing subsystem
```

## Expected behavior

The assets named `*-installer-signed.pkg` should pass `pkgutil --check-signature` and Gatekeeper installer assessment, or the release notes/docs should explain why these packages are not expected to validate with macOS package-signature tooling.

## Actual behavior

Both checked packages match the GitHub-published SHA-256 digest, but macOS reports invalid package signatures, so I did not proceed with installation.

## Additional notes

The payload itself appears to contain the expected files under `/usr/local/bin` and `/usr/local/libexec/container`, but I avoided installing because the package signature validation failed.