🤖 Fix: Remove unnecessary DMG signing and split artifacts

[ammario]

Problem

1. PR 🤖 Fix: Enable DMG code signing #83 added dmg.sign: true which is actually unnecessary and discouraged by electron-builder
2. Both DMG files (x64 and arm64) are being uploaded as a single artifact, making it confusing for users

Solution

1. Removed dmg.sign: true - DMG signing is not needed and can cause issues. What matters is the .app bundle signing (which works perfectly)
2. Split artifacts - Now uploading as separate macos-dmg-x64 and macos-dmg-arm64 artifacts for clarity

Why DMG signing is unnecessary

According to electron-builder documentation: "Signing is not required and will lead to unwanted errors in combination with notarization requirements."

The .app bundle inside the DMG is properly signed with:

• Developer ID Application certificate
• Hardened Runtime enabled
• All frameworks and helpers signed
• Valid certificate chain through Apple Root CA

✅ Verified on local machine: codesign --verify --deep --strict passes

Changes

# .github/workflows/build.yml
- name: Upload macOS DMG (x64)
  path: release/*-x64.dmg
  
- name: Upload macOS DMG (arm64)
  path: release/*-arm64.dmg

// package.json - removed dmg section entirely
"mac": {
  "target": [
    { "target": "dmg", "arch": "x64" },
    { "target": "dmg", "arch": "arm64" }
  ],
  ...
}

Generated with cmux