Ship a self-contained macOS flashing engine

[alibros]

Summary

• bundle a release-only Apple Silicon dfu-util 0.11 sidecar so users no longer need Homebrew or Terminal setup
• build dfu-util and libusb 1.0.30 from checksum-pinned upstream source and statically link the USB library
• force production firmware writes through the embedded helper while preserving local paths only for debug builds
• expose flashing-engine readiness and version in the app and block installation if the packaged engine is unavailable
• ad-hoc sign the complete app bundle, including the nested helper and licence resources
• attach exact corresponding source archives for both bundled third-party components to every macOS release
• bump Touch Manager to 0.3.0 and correct the 0.2.0 changelog section

User impact

The official DMG becomes self-contained: install Touch Manager, connect Touch 2, and flash firmware without installing dfu-util, Homebrew, Rust, or any other command-line dependency.

Reproducibility and compliance

• dfu-util 0.11 source SHA-256: b4b53ba21a82ef7e3d4c47df2952adf5fa494f499b6b0b57c58c5d04ae8ff19e
• libusb 1.0.30 source SHA-256: fea36f34f9156400209595e300840767ab1a385ede1dc7ee893015aea9c6dbaf
• the build rejects helpers that retain Homebrew, local, or dynamic libusb dependencies
• GPL-2.0-or-later and LGPL-2.1-or-later texts are included in the application resources
• both exact source archives are uploaded alongside the DMG

Validation

• npm test — 9 Rust/backend tests passed
• npm run build
• npm audit --omit=dev — 0 vulnerabilities
• cargo fmt --all -- --check
• cargo metadata --locked --no-deps
• bash -n .github/scripts/build-dfu-util-macos.sh
• local release helper built from both pinned source archives
• local 0.3.0 DMG built successfully
• embedded helper reports dfu-util 0.11
• embedded helper is ARM64 and links only Apple system frameworks
• bundled GPL/LGPL resources verified
• codesign --verify --deep --strict passed on the app extracted from the DMG
• git diff --check

Release

After merge, tag v0.3.0. The tag workflow will publish the self-contained Apple Silicon DMG plus both corresponding source archives.