Your agent team, on the desktop. Native .dmg, drag-and-drop install.
Signed with an Apple Developer ID, notarized by Apple, and the .dmg is stapled. Gatekeeper verifies offline.
Future releases stream in silently; the next launch flips to the latest.