Release pipeline: resign-mac.mjs must repackage zip/dmg (and produce styled dmg)

[germanescobar]

Problem

npm run package:electron:dist runs electron-builder --mac --linux then electron/resign-mac.mjs. But electron-builder builds the .zip and .dmg before the resign step runs, and resign-mac.mjs only re-signs the loose release/mac-arm64/Controller.app — it never repackages the archives.

Result: the distributed Controller-X.Y.Z-arm64-mac.zip / .dmg carry electron-builder's original signature (flags=0x10002(adhoc,runtime)), not the clean re-sign (flags=0x2(adhoc)). That malformed signature is the cause of the macOS "damaged → Move to Trash" Gatekeeper dead-end (rather than the normal "Open Anyway" dialog).

This was patched by hand for both 0.1.0 and 0.2.0 by repackaging the archives from the resigned .app after the build. The documented procedure in RELEASING.md does not capture this manual step.

Verification (0.2.0)

# signature inside the as-built zip:
CodeDirectory ... flags=0x10002(adhoc,runtime)   # malformed → rejected dead-end

# resigned .app on disk:
CodeDirectory ... flags=0x2(adhoc)               # well-formed → Open Anyway works

Proposed fix

1. Make resign-mac.mjs (or a follow-on step) repackage the zip and dmg from the resigned .app, so package:electron:dist produces correct archives in one command.
2. Preserve electron-builder's styled dmg (background + window layout). The 0.2.0 dmg was rebuilt with plain hdiutil and lacks the styling; a proper fix should re-emit the styled dmg containing the resigned app.
3. Update RELEASING.md to drop the now-unnecessary manual repackage note once the script handles it.

Acceptance

• npm run package:electron:dist emits zip + dmg whose embedded .app shows flags=0x2(adhoc) and passes codesign --verify --deep --strict.
• dmg retains the styled layout.