ensure-host-tools.sh always bootstraps xcodegen. dmgbuild now lives in build/.venv-dmgbuild and is only installed when INSTALL_DMGBUILD=1 (package job). The test job no longer pip-installs dmgbuild, which is what failed on Python 3.9. package-release.sh reuses that venv (or bootstraps it locally) instead of creating a second copy.