feat(packaging): the unsigned macOS .dmg built in CI, and the docs for steps 3 and 4 (P11a step 6, macOS half)

cargo-packager's dmg format (it makes the .app first) from
deploy/packaging/packager-macos.toml, an Info.plist merged into the
generated one, build-macos.sh in portable shell (BSD sed) and a
package-macos recipe; the release workflow gets a macos job on
macos-latest that uploads the .dmg as a run artifact and attaches it on a
tag. Unsigned and not notarized: that is step 5 (the owner's Developer ID,
Q-4). The config was parsed under cargo-packager 0.11.8's strict schema on
Linux; the build itself needs the CI run. No new dependency.
docs/packaging.md (macOS rows, finding 7 resolved, the staged update),
architecture.md and testing.md describe steps 3 and 4.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

deploy/packaging/build-macos.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# The macOS bundle (P11a step 6), UNSIGNED, from the release program
+# already built at target/release/wanderbooks (`cargo build --release -p
+# ledger-cli`). Run on a Mac from the repository root:
+#
+#   build-macos.sh [VERSION]
+#
+# Puts Wanderbooks_VERSION_<arch>.dmg into target/packages/VERSION/. It
+# is not signed or notarized (step 5): Gatekeeper refuses it on a Mac
+# that downloaded it, and the owner opens it with right-click > Open.
+# Portable shell: macOS has BSD sed and no GNU mktemp options.
+set -euo pipefail
+own=$(sed -n 's/^version = "\(.*\)"/\1/p' crates/ledger-cli/Cargo.toml | head -n1)
+version=${1:-$own}
+out="target/packages/$version"
+program=${WB_PROGRAM:-target/release/wanderbooks}
+test -x "$program" || { echo "build the release program first: cargo build --release -p ledger-cli" >&2; exit 1; }
+rm -rf "$out"; mkdir -p "$out"
+stage="target/packages/.stage-$version"
+rm -rf "$stage"; mkdir -p "$stage"
+cp "$program" "$stage/wanderbooks"
+config="$stage/packager.toml"
+# cargo-packager reads paths relative to the config file, which is in the
+# stage folder here, so they are made absolute.
+sed -e "s/^version = \".*\"/version = \"$version\"/" \
+    -e "s#^out-dir = .*#out-dir = \"$PWD/$out\"#" \
+    -e "s#\"target/release\"#\"$PWD/$stage\"#" \
+    -e "s#\"deploy/packaging/#\"$PWD/deploy/packaging/#" \
+    -e "s#\"LICENSE-MIT\"#\"$PWD/LICENSE-MIT\"#" \
+    deploy/packaging/packager-macos.toml >"$config"
+cargo packager --config "$config" --formats dmg --release
+rm -rf "$stage"
+ls -l "$out"