Inspect macOS DMG before release

[lyc-aon]

What changed

• mount the built DMG at a unique temporary path with hdiutil attach -readonly -nobrowse -noautoopen
• locate the single application bundle and run the existing package inspector against its real Contents root
• detach in cleanup on both success and inspection failure, with a force-detach fallback if the normal detach is busy
• preserve the mount point and fail the release if detachment cannot complete
• run DMG inspection before the artifact is staged for publication

Verification

• pnpm check
• pnpm test
• pnpm test:tooling
• pnpm build:web && pnpm build:desktop
• pnpm test:packaging — 18 passed
• native Apple Silicon macOS smoke against the published v0.1.2 DMG — 916 ASAR entries inspected, image detached, no temporary mount left behind