pkg: unconditional `<domains>` in distribution.xml triggers "Installer would like to access data from other apps" TCC prompt on macOS 26

* **Electron-Builder Version**: 26.8.1 (the code path is identical in 26.15.3 `latest`, 26.16.0 `v26`, 27.0.0-alpha.8 `next`, and `master` — see below)
* **Electron Updater (as-needed)**: 6.8.3 (not involved)
* **Node Version**: v22.23.1
* **Electron Version**: 39.8.10
* **Platform & Target**: macOS 26.5.2 (25F84), Apple silicon → `mac.target: pkg`
* **Debug Logs**: not a build failure — the build succeeds and the `.pkg` installs. The relevant log is the `tccd` excerpt below, captured on the machine running the installer.

### Summary

On macOS 26, every `.pkg` produced by the `pkg` target makes Installer.app show the TCC prompt **"Installer would like to access data from other apps"** as soon as the user clicks *Continue* on the Introduction pane — before any file is written and before `preinstall` runs.

The trigger is the `` element that `PkgTarget.customizeDistributionConfiguration` unconditionally appends to `distribution.xml`:

```xml

```

`` is a deprecated Distribution element. While building the install plan, macOS 26's Installer probes the current-user-home domain when it sees this element — even with `enable_currentUserHome="false"` — and because Installer.app is sandboxed, that probe hits `kTCCServiceSystemPolicyAppData` and the prompt appears. Adding `rootVolumeOnly="true"` to `` (the current spelling for the same restriction) makes the prompt go away with no change in install behaviour.

There is no configuration escape hatch: the element is inserted regardless of `allowAnywhere` / `allowCurrentUserHome` / `allowRootDirectory`, and `pkg.productbuild` can only append arguments after the `--distribution` that is already fixed.

### Environment

- electron-builder / app-builder-lib **26.8.1**. The same unconditional insertion is present in 26.15.3 (`latest`), 26.16.0 (`v26`), 27.0.0-alpha.8 (`next`) and `master` (`packages/app-builder-lib/src/targets/mac/pkg.ts`), so upgrading does not help.
- macOS 26.5.2 (25F84), Installer.app `Installer-1359.120.1`, Apple silicon.
- Config that reproduces it (nothing unusual):

```yaml
mac:
target: [pkg]
pkg:
installLocation: /Applications
allowAnywhere: false
allowCurrentUserHome: false
isRelocatable: false
```

### Steps to reproduce

1. Build any app with the `pkg` target on macOS 26.
2. Double-click the `.pkg`, click **Continue** on the Introduction pane.
3. The prompt *"Installer" would like to access data from other apps* appears.

The prompt is a one-time TCC decision per machine, so it only shows once per user until the record is reset. To reproduce repeatedly:

```sh
tccutil reset SystemPolicyAppData com.apple.installer
open -a Installer MyApp.pkg # then click Continue
```

### Evidence

`tccd` attributes the request to Installer.app itself, not to any package script (scripts have not run yet at this point):

```
tccd: AUTHREQ_PROMPTING: service=kTCCServiceSystemPolicyAppData,
subject=Sub:{com.apple.installer}
binary_path=/System/Library/CoreServices/Installer.app/Contents/MacOS/Installer
```

Bisected by rebuilding the same component package with single-variable changes to `distribution.xml` and counting Installer's `kTCCServiceSystemPolicyAppData` requests in `log show` after clicking Continue (TCC reset before every run):

| Variant | AppData requests |
|---|---|
| as generated by electron-builder | 4 (prompt shown) |
| identical, but unsigned | 4 → signing is irrelevant |
| payload reduced to a bare `Contents/Info.plist` | 4 → payload is irrelevant |
| `preinstall` / `postinstall` removed | 4 → scripts are irrelevant |
| `` / `` / `` removed (one at a time) | 4 / 4 / 4 |
| **`` removed** | **0** |
| minimal `productbuild --synthesize` output **plus only ``** | **4** |
| `` kept, `rootVolumeOnly="true"` added to `` | **0** |

Install-domain behaviour is unchanged by the fix (`installer -pkg … -volinfo` / `-dominfo`):

| Distribution | `-volinfo` | `-dominfo` | prompt |
|---|---|---|---|
| current (`` only) | `/` | `LocalSystem` | yes |
| `` + `rootVolumeOnly="true"` | `/` | `LocalSystem` | no |
| `` removed, `rootVolumeOnly="true"` | `/` | *(empty)* | no |
| `` removed, nothing added | `/` + `/System/Volumes/Update/mnt1` | *(empty)* | — |

The last row is why the element should not simply be dropped: without either restriction, Installer offers the system update snapshot volume as an install target.

### Proposed fix

Smallest change that keeps the existing `` output byte-for-byte and only adds the attribute when both user-home options are off (which is when `` and `rootVolumeOnly` express the same thing). In `packages/app-builder-lib/src/targets/mac/pkg.ts`, before the `` insertion:

```ts
// `` is deprecated; on macOS 26 the Installer probes the user-home
// domain while parsing it — even with enable_currentUserHome="false" — which
// trips kTCCServiceSystemPolicyAppData and prompts for "data from other apps".
// `rootVolumeOnly` is the current spelling of the same restriction.
if (options.allowAnywhere === false && options.allowCurrentUserHome === false) {
distInfo = distInfo.replace("")
// existing insertion unchanged
```

Doing the `replace` before `insertIndex` is computed keeps the later `background` / `welcome` / `license` / `conclusion` insertions valid.

Verified with a real electron-builder build on the config above: `distribution.xml` gets ``, the prompt no longer appears, `-volinfo` / `-dominfo` are identical to before.

Happy to open a PR with this change if that helps.

Start in packages/app-builder-lib/src/targets/mac/pkg.ts, at PkgTarget.customizeDistributionConfiguration and its distribution.xml generation. Reproduce with the mac.target: pkg configuration on macOS 26, then verify that the generated distribution retains the existing install domains, no longer prompts for access to data from other apps, and preserves the reported -volinfo and -dominfo behavior.

Written by the indexing model from the issue text.