Fix updater app copy preserving framework symlinks

[constansino]

Fixes #3218.

Summary

• replace the updater's cp -rf app copy with /usr/bin/ditto
• share the app install step between both updater launch paths
• preserve framework bundle symlinks from the mounted DMG so Gatekeeper keeps accepting the installed app

Verification

• bash -n Kit/scripts/updater.sh
• Ran Kit/scripts/updater.sh against a fake Stats.app containing framework-style symlinks and confirmed Test.framework/Test, Test.framework/Resources, and Test.framework/Versions/Current remain symlinks after install.
• Reproduced the released v2.12.14 DMG behavior locally: cp -rf copy is rejected by spctl with bundle format is ambiguous, while a ditto copy is accepted as Notarized Developer ID.