macos-dmg.yml cannot be dispatched from a branch with a '/' in its name, which is the only pre-merge test it has #4710

Summary

macos-dmg.yml builds the DMG filename from github.ref_name:

"AetherSDR-${{ github.ref_name }}-macOS-${{ matrix.label }}.dmg"

That is correct for the workflow's push: tags: ['v*'] trigger, where
ref_name is v26.8.1. It is broken for its other trigger,
workflow_dispatch, on any branch whose name contains a / — because the
filename then contains a path separator and create-dmg tries to write into a
directory that does not exist.

Given the repo's ci/, fix/, feat/, docs/ branch convention, that is
nearly every branch anyone would want to dispatch from.

Why it matters

macos-dmg.yml is tag-triggered, so nothing in a PR ever exercises it —
macdeployqt, code signing, notarization, and (as of #4695) the bundled-Qt
assertion are all release-time-only. A workflow_dispatch run against the merge
candidate is the only pre-merge test that exists for those steps, and #4688 §1
called it out as the real gate for #4695.

Hitting this while trying to run that gate is what surfaced it: dispatching from
ci/pin-macos-arm-qt would have produced

AetherSDR-ci/pin-macos-arm-qt-macOS-apple-silicon.dmg

The run dies at packaging, after everything worth testing has already passed —
so it reads as "the release path is broken" when the release path is fine and
only the filename is wrong. The workaround was to push a slash-free branch at the
same commit and dispatch that, which works but is one more undocumented step
between a maintainer and the only test that covers the release job.

Affected lines

.github/workflows/macos-dmg.yml — every use of the name, currently five:

• L593 create-dmg … "AetherSDR-${{ github.ref_name }}-…dmg"
• L606 DMG="AetherSDR-${{ github.ref_name }}-…dmg" (the existence check)
• L618 codesign
• L627 notarize
• L645 staple

Suggested fix

Compute the name once, sanitised, and reuse it — which also removes the
five-way repetition that would let those drift apart:

      - name: Derive artifact name
        run: |
          # ref_name is a tag on the release path (v26.8.1) but a branch name on
          # workflow_dispatch, and branch names contain '/' — which would put a
          # path separator in the filename and fail create-dmg. Dispatch runs are
          # the only pre-merge coverage this workflow gets, so they have to work.
          echo "DMG_NAME=AetherSDR-${GITHUB_REF_NAME//\//-}-macOS-${{ matrix.label }}.dmg" >> "$GITHUB_ENV"

then "$DMG_NAME" at all five sites. Tag runs are unaffected — a tag has no /,
so the substitution is a no-op and the filenames released stay byte-identical.

Scope

CI-only; no source change. Worth pairing with a line in docs/ or the workflow
header noting that dispatching this workflow is the pre-merge test for the macOS
release path, since that is not discoverable from the file today.