Polish and harden DMG installation experience

[IchenDEV]

Outcome

Opening the release DMG now presents a compact, branded Finder window with a clear Utter-to-Applications drag flow, readable native Finder labels, a Retina background, and a custom volume icon. Packaging no longer depends on Finder automation, and its Python tooling is version- and hash-pinned.

SDLC bundle and risk

• Bundle: docs/sdlc/changes/2026-08-26-dmg-installer-polish
• Risk: high
• Human decisions still required: independent review of the packaging dependency boundary and rollback; configured release signing, notarization, and publication remain protected release decisions.

Verification

• python3 scripts/sdlc.py validate --worktree
• bash scripts/ci-basic-checks.sh
• swift test — 564 XCTest tests, 8 skipped, 0 failures; 1 Swift Testing test passed
• Release-style app build — build-app.sh --version=0.0.0 --sign=-; built-in artifact verification passed
• Mounted DMG checks — checksum, strict deep code signature, arm64 architecture, Applications symlink, Retina background, and exact Finder layout metadata passed
• Real-window QA — the final installer design was inspected in Finder; the latest-base screenshot recapture failed in ScreenCaptureKit, with final-artifact visual invariants rechecked independently and the limitation recorded in the verification bundle
• Privacy, permission, external-service, and failure paths — not affected by this packaging-only change

Residual risk and rollback

The high-risk dependency and packaging change still requires independent review. Developer ID signing and notarization can only be proven in the protected release environment. dmgbuild currently emits non-fatal macOS 26 hdiutil deprecation warnings, and the reviewer should spot-check the Finder window because the latest screenshot recapture tool was unavailable.

Rollback is a straight revert of this PR, restoring the previous hdiutil create -srcfolder DMG path without touching application runtime code or user data.

Reviewer focus

Please focus on the hash-pinned Python packaging boundary, preservation of the mounted app signature, the non-interactive Finder metadata, and whether the documented macOS 26 deprecation risk is acceptable for this release.