[grade=B] feat: real macOS .dmg built entirely on Linux (libguestfs + libdmg-hfsplus)

Adds scripts/build-dmg-linux.sh + 'npm run build:dmg':
- virt-make-fs creates an HFS+ volume inside a plain 400M image file
  (guestfs appliance; never touches block devices)
- libdmg-hfsplus converts it to compressed UDZO .dmg (real koly/UDIF)
- app + /Applications drag-install symlink; secret scan on extracted contents
- BUILD_GUIDE documents the route + Gatekeeper first-run note

Verified end-to-end: rc=0, 121MB DMG with valid koly trailer,
extractall round-trip reproduced the full 264MB app, secrets scan clean.

dashcaddy-installer/package.json

@@ -12,7 +12,8 @@
     "build:win": "electron-builder --win",
     "build:mac": "electron-builder --mac",
     "build:linux": "electron-builder --linux",
-    "build:scan": "bash scripts/check-artifact-secrets.sh build-output"
+    "build:scan": "bash scripts/check-artifact-secrets.sh build-output",
+    "build:dmg": "npm run build:mac && bash scripts/build-dmg-linux.sh"
   },
   "keywords": [
     "dashcaddy",