publicDownloadUrl built the disk image URL from manifest.version, but the
version carries a build suffix the release tag does not: version
"1.0.0-alpha.3.app.59" lives under tag "1.0.0-alpha.3". Every macOS
visitor was handed a 404.
Derive it from the updater URL instead, rewriting only the filename so
the tag comes from the release directory the manifest points at.