Ship the app as a drag-to-Applications disk image, and the tools as a zip

[evandhoffman]

A release now ships the app as a drag-to-Applications disk image, and the headless tools in a zip of their own.

File	Holds
monitor-<version>.dmg	monitor.app beside a link to /Applications
monitor-tools-<version>.zip	monitord, monitor-exporter, install-exporter.sh

Each has a .sha256 beside it. The tools stay out of the image: a drag window offers one gesture, and binaries beside the app would make it unclear what to drag.

How it is built

1. Scripts/make-app.sh builds and signs everything, as before.
2. Scripts/notarize.sh .build/package submits the app and the tools in one throwaway zip and staples the app. It no longer builds the published zip.
3. Scripts/make-dmg.sh (new) puts the stapled app in the image, then signs, notarizes and staples the image.
4. package.yml zips the tools.

The app is stapled before it goes into the image, so the copy dragged out carries its own ticket and opens offline. The image carries its own ticket for mounting it.

No background picture or icon positions. Those need a .DS_Store that only Finder writes. The plain window still shows the app and the Applications link side by side.

Also fixed

• ._ files in the zip. The runner tags every file with com.apple.provenance, and ditto stored it as a ._ file beside each one. The v1.8.0 zip has ten of them; unzip in Terminal leaves them behind. The tools zip is now made with --norsrc --noextattr --noacl. Signatures are inside the binaries, so nothing is lost.
• "Apple silicon or Intel" in the release notes. Every release binary is arm64 only (lipo -archs), so the notes and README now say Apple silicon.

Checked

• Locally, signed and notarized for real: both notary submissions accepted. Mounted the image with -nobrowse: it holds Applications -> /Applications and monitor.app; the app inside is stapled and Gatekeeper reports Notarized Developer ID.
• On the runner: package.yml dispatched on this branch, twice. It publishes nothing and uploads the files as an artifact. Downloaded the second run's artifact: checksums match, the image passes spctl --type open as Notarized Developer ID, and the tools zip lists exactly the three files.
• hdiutil prints a deprecation warning on macOS 27. It still works; make-dmg.sh says why it stays and what replaces it.

Merging ships the first release in the new shape.