[BUG] macOS DMG packaging skips app-bundle signing

[marcomarcogd]

Bug Description

The macOS packaging tasks and release workflows create a DMG without signing the completed .app bundle. The executable may carry a linker-generated ad-hoc signature, but the bundle does not have sealed resources or a signature bound to Info.plist.

Steps To Reproduce

1. Run task darwin:package on current main.
2. Mount the generated DMG read-only.
3. Run codesign --verify --deep --strict --verbose=2 <mount>/MrRSS.app.

Expected Behavior

The packaged app bundle passes strict codesign verification before a DMG is published.

Actual Behavior

Strict verification fails because package depends on build rather than sign:dev, and both GitHub Actions workflows invoke create-dmg.sh without signing the app. Attempting to sign with the current heavily commented entitlement file also fails on the current macOS toolchain with an AMFI XML parse error.

Screenshots

Not applicable; the verification output is included below.

Environment

• OS: macOS 26.6.1 (arm64)
• MrRSS Version: main at 334b1971 / v1.3.26
• Installation Method: local task darwin:package

Additional Context

The installer steps currently use continue-on-error: true, so a failed or missing DMG can also be ignored by the release job.

Logs

Info.plist=not bound
Sealed Resources=none
Failed to parse entitlements: AMFIUnserializeXML: syntax error near line 1

Possible Solution

Use the existing ad-hoc signing task before local packaging, sign and strictly verify the bundle in both macOS workflows before creating the DMG, normalize the entitlement plist, and make installer failure fatal.