System installs land in /Applications where Velopack's UpdateMac may not
be able to replace the .app during auto-update. Restricting the
distribution domains to currentUserHome skips the Destination Select
page and needs no admin rights; the postinstall script's sudo prefixes
are dropped since it already runs as the installing user.