Build a macOS installer .pkg from the staged install payload

[chrisuthe]

Third slice of roadmap item 10, and the one it named as the untested half of the
payload: the .pkg. The payload the first slice already stages is the input
rather than something built again, so the installer ships exactly the files the
install() rules do and cannot drift from the tarball published beside it.

What is here

scripts/build_macos_pkg.sh wraps a staged DESTDIR tree. A script rather than
lines in ci.yml for two reasons: an installer has to be buildable and
installable by a developer with no runner, and scripts/*.sh is already gated
by the shellcheck job, so it arrives linted with no workflow change.

• pkgbuild --root <payload>/usr/local --install-location /usr/local, not a
  root one level up paired with /usr. The staged tree carries BUILD-INFO.txt
  beside usr/ for the tarball's readers, and the wider root would install that
  file at / — excluded structurally, by where the root points, rather than by
  a filter a later tidy-up can drop. --ownership recommended is named although
  it is the default, because it is what makes the installed files root:wheel.
• productbuild over the component, for two things a component package
  cannot do. It has no architecture gate, so an arm64-only installer reports
  success on an Intel Mac and leaves a binary answering Bad CPU type in executable; <options hostArchitectures> is the declarative gate, and the
  value is read off the binary with lipo rather than passed in, so a universal
  build widens the installer by itself. And distribution panes are a
  product-archive feature, so a component package has nowhere to say the
  installer is unsigned at the moment somebody is deciding whether to run it.
• The destination is /usr/local, not /opt — not a free choice. The
  prefix is baked in at configure time and the install rules already chose it.

Signing is absent, not stubbed

Out of scope per the brief, and gated on an enrolment that has not happened. No
placeholder --sign branch, no commented-out codesign, nothing assuming
secrets — a public repo gets none on a fork PR. The .pkg is what makes signing
possible later: xcrun stapler staples to a .app, .dmg or .pkg and
refuses a bare Mach-O, and that constraint is written at the build site.

It is shipped honestly meanwhile. The welcome pane and README.md both say it
is unsigned, and README.md states plainly that the .pkg is not the
Gatekeeper fix, then separates the three paths that genuinely differ: an
Actions artifact arrives as a zip, so the browser quarantines the zip and the
.pkg inherits the flag only from Finder's Archive Utility and not from
unzip; installer -pkg makes no Gatekeeper assessment at all; a locally built
one is never quarantined. What the .pkg does fix is narrow and named as such —
installer does not quarantine what it writes, so the installed binary needs no
xattr -d. That is convenience, not identity.

Verification

CI installs it at / on the macOS leg and checks what came out: the receipt's
file list, version: and location:, then --version and the whole smoke
suite against /usr/local/bin/sendspin-cli rather than a build-tree binary. An
installer nobody installed is not shipped.

Green on all five jobs. installer reports success, the receipt reads
location: usr/local, and the smoke suite passes against the installed binary.
Locally: a real universal binary (clang -arch arm64 -arch x86_64) widens the
declaration to hostArchitectures="x86_64,arm64" by itself, and the empty
version and missing payload guards both refuse with the message that names the
fix. shellcheck and actionlint clean.

Roadmap item 10 records what shipped, and keeps two entries owed with owners
named: Developer ID signing and notarization, and a minimum-macOS gate the
architecture gate's asymmetry exposes.