build(dmg): package the self-contained companion

[LMLiam]

Goal

Create a reproducible GitHub Release DMG that needs no Homebrew installation.

Acceptance criteria

• Bundle the app, extension, CLI, and helper payload.
• Verify arm64 and x86_64 slices.
• Apply ad-hoc nested signatures.
• Contain only the app and Applications symlink.
• Produce a portable SHA-256 checksum.
• Match the documented unnotarised Gatekeeper behaviour.
• Upload only after release-please creates a release.

Owned files

DMG embedding and packaging scripts, their tests, and the release upload job.

Dependencies

Native companion feasibility must pass.

Verification

bash Tests/Scripts/run-dmg-packaging-tests.sh
bash scripts/package-dmg.sh 0.1.0 .build/releases
hdiutil verify .build/releases/clamshellctl-v0.1.0.dmg