feat(packaging): pack macos builds as a dmg disk image

.github/workflows/build.yml

@@ -1,7 +1,8 @@
 # Manual-only release build (PLAN §7.2): no push or pull_request trigger.
 # Each RID job runs build -> test -> publish/pack -> upload; a failing step
 # skips the rest of that job, so a RID whose tests fail produces no artifact.
-# win-x64 packs an Inno Setup installer; the other RIDs keep tar.gz archives.
+# win-x64 packs an Inno Setup installer; linux-x64 a tar.gz; osx-arm64 a
+# drag-to-Applications dmg.
 # Artifacts are uploaded unzipped (upload-artifact archive: false): each RID's
 # dist/ holds exactly one file, and its name becomes the artifact name.
 # No GitHub Release is created.