feat(packaging): the unsigned macOS .dmg built in CI, and the docs for steps 3 and 4 (P11a step 6, macOS half)

cargo-packager's dmg format (it makes the .app first) from
deploy/packaging/packager-macos.toml, an Info.plist merged into the
generated one, build-macos.sh in portable shell (BSD sed) and a
package-macos recipe; the release workflow gets a macos job on
macos-latest that uploads the .dmg as a run artifact and attaches it on a
tag. Unsigned and not notarized: that is step 5 (the owner's Developer ID,
Q-4). The config was parsed under cargo-packager 0.11.8's strict schema on
Linux; the build itself needs the CI run. No new dependency.
docs/packaging.md (macOS rows, finding 7 resolved, the staged update),
architecture.md and testing.md describe steps 3 and 4.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

docs/testing.md

@@ -3711,6 +3711,25 @@ it (the same program with a tail, so its hash differs). All in
   file now on disk (not a deleted one). The host's own restart laws stay
   `open_while_held.rs`'s (`a_restart_is_not_a_close`).
 
+Step 3's gap and step 4 (same file):
+
+- `a_replaced_appimage_restarts_the_books`: the programs run from one copy
+  (a mount's) while `APPIMAGE` names another (the image); `update`
+  replaces only the image; the host restarts onto it (its `/proc/PID/exe`
+  is the image), the mount's copy is untouched, the session writes on.
+- `the_host_stages_a_daily_update_and_the_next_start_applies_it`: with a
+  local feed named in `updates/feed`, the host stages 9.0.0 by itself;
+  the program, the host and the session are unchanged meanwhile; after
+  `close`, the next opener applies it (the old program is kept, the staged
+  folder gone) and the books are as they were.
+- `a_daily_update_that_is_not_ours_is_not_staged`: a signature by another
+  key, then a wrong sha256, each looked at and neither staged.
+- `update_installs_the_copy_the_host_staged_without_downloading_again`: the
+  release's file is deleted; `update` installs from the staged copy.
+- `a_staged_update_that_was_tampered_with_is_dropped_not_applied`: a staged
+  file edited together with its recorded checksum fails the signature; the
+  next start drops it and runs the old program.
+
 Unit tests in `update.rs`: `versions_are_three_numbers_and_order_by_number`,
 `a_package_marker_beside_the_program_makes_it_package_managed`,
 `a_manifest_address_is_resolved_beside_the_manifest`,