[grade=B] feat: real macOS .dmg built entirely on Linux (libguestfs + libdmg-hfsplus)

Adds scripts/build-dmg-linux.sh + 'npm run build:dmg':
- virt-make-fs creates an HFS+ volume inside a plain 400M image file
  (guestfs appliance; never touches block devices)
- libdmg-hfsplus converts it to compressed UDZO .dmg (real koly/UDIF)
- app + /Applications drag-install symlink; secret scan on extracted contents
- BUILD_GUIDE documents the route + Gatekeeper first-run note

Verified end-to-end: rc=0, 121MB DMG with valid koly trailer,
extractall round-trip reproduced the full 264MB app, secrets scan clean.

dashcaddy-installer/BUILD_GUIDE.md

@@ -58,9 +58,13 @@ npm run build
 # Windows (creates portable .exe and installer)
 npm run build:win
 
-# macOS (creates .dmg)
+# macOS zip (from any host; electron-builder's native target)
 npm run build:mac
 
+# macOS real drag-install .dmg — built ON LINUX, no Mac needed
+# (one-time toolchain: see scripts/build-dmg-linux.sh header)
+npm run build:dmg
+
 # Linux (creates AppImage and .deb)
 npm run build:linux
 ```
@@ -73,8 +77,12 @@ Built applications are placed in the `build-output/` directory:
   `build-output/DashCaddy Installer Setup <version>.exe` (NSIS installer)
   — filenames embed the current `version` from package.json
 - **macOS**: `build-output/DashCaddy Installer-<version>-mac.zip` — the
-  configured mac target is `zip` (unsigned; signed `.dmg` builds require
-  a Mac with signing credentials)
+  configured mac target is `zip` (unsigned; signed builds require a Mac
+  with signing credentials). `npm run build:dmg` additionally produces a
+  real drag-install `build-output/DashCaddy Installer-<version>.dmg`
+  built entirely on Linux (libguestfs HFS+ volume + libdmg-hfsplus UDZO
+  compression; unsigned — macOS Gatekeeper will show the standard
+  right-click→Open dialog on first launch)
 - **Linux**: `build-output/DashCaddy Installer-<version>.AppImage` and
   `build-output/dashcaddy-installer_<version>_amd64.deb`