asepsisctl: make install_wrapper and uninstall_wrapper more robust

1. we create additional time-stamped panic backup with every new asepsis install
2. asepsisctl uninstall_wrapper --panic restores latest panic backup
3. asepsisctl install_wrapper newly rejects to install if asepsis wrapper is present
4. asepsisctl uninstall_wrapper skips backup restoration in case asepsis wrapper is not present
code signing the wrapper must be done in-place (fixes #13)

Historical note:
Originally I signed wrapper file in resources folder and then copied the files.
Some users reported Asepsis failures when upgrading to 10.9.3:
https://github.com/binaryage/asepsis/issues/13

The kernel is checking mtime of the binary with cs_mtime of code signature, these must match.
Solution is to first copy files to destination folder and execute codesign there.
This should ensure mtime and cs_mtimes are the same.
use archive-mode when copying files to/from backup location
asepsisctl diagnose prints more friendly message when wrapper was uninstalled cleanly
payload tasks moved to badev
mach_override_notes.txt no longer relevant
updated license
don't bundle codesign, prompt user to install xcode commandline tools
installer: use flat build format (mpkg->pkg)
improved packaging

* Platypus replaced with custom uninstaller (from TotalFinder)
* updated Sparkle
* package is code-signed
fix typo
add --timestamp=none to codesign, prevents contacting online servers
require Xcode command-line tools as a prerequisity
SHARED_GLOBAL_DATA is not needed
update uninstaller
rake clean does more work
fix broken paths
do lipo and strip symbols in release build
improve message when asepsis is broken
be explicit and hold delegate strongly