Why does Encrypt-Then-Sign not yield a CCA-secure public-key encryption scheme?
I am not sure how the IND-CCA experiment in this case works.

Well, it doesn't really. There are no verification keys designated as such in the CCA experiment and there is no designated sender in the definition of a public key encryption scheme at all.
So, the only way to communicate to the receiver who supposedly encrypted a ciphertext would be to put it in the ciphertext itself. However, the encryption process takes as input only the encryption key and the message. So where is the signing key going to come from?
The answer is: Either it needs to be an input, in which case what you have is no longer even syntactically an encryption scheme, or you could generate a fresh keypair every time you encrypt. But since those would not be bound to anything this would be useless.

How can an adversary use this property to win the IND-CCA security experiment?

Choose two arbitrary messages $m_0\neq m_1$ and output them as a challenge. Receive the challenge ciphertext $C^* = (c^*,\sigma)$ where $\sigma$ is a signature on $c^*$ under some key which we will have to assume that the receipient magically knows.
Generate a new keypair, sign $c^*$ again, resulting in $\sigma'$ and ask the challenger to decrypt $C'=(c^*,\sigma')$. Since $\sigma'$ is valid, and therefore $C' \neq C^*$ is distributed identically to a ciphertext honestly generated by the attacker we will receive back $m_b$, thus breaking CCA security.