feat(macos): сборка DMG, фикс keychain и opus-библиотек

- secure storage: usesDataProtectionKeychain=false — вход в аккаунт
  больше не падает с -34018 без аккаунта разработчика
- entitlements: убран app-sandbox/keychain-access-groups (adhoc без Team ID)
- иконка: squircle с прозрачными полями (нативный macOS-вид)
- opus/ogg: битые bitcode-библиотеки ogg_opus_player заменены на
  собранные из исходников universal (.a в macos/prebuilt/opus +
  scripts/fix_opus_macos.sh применяет их после pub get)
- scripts/build_dmg.sh: adhoc-сборка universal DMG с дизайном (create-dmg)
- CI: build-macos.yml собирает DMG-артефакт; flutter-main.yml чинит libs

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/build-macos.yml

@@ -35,22 +35,16 @@ jobs:
           flutter-version: ${{ env.FLUTTER_VERSION }}
           channel: 'stable'
 
-      - name: Get dependencies
-        run: flutter pub get
+      - name: Install create-dmg
+        run: brew install create-dmg
 
-      - name: Build macOS
-        run: flutter build macos --release
+      - name: Build signed DMG
+        run: ./scripts/build_dmg.sh
 
-      - name: Package macOS
-        run: |
-          mkdir -p dist
-          APP=$(find build/macos/Build/Products/Release -maxdepth 1 -name "*.app" | head -1)
-          ditto -c -k --keepParent "$APP" dist/Komet-macos.zip
-
-      - name: Upload macOS artifact
+      - name: Upload macOS DMG artifact
         uses: actions/upload-artifact@v4
         with:
           name: komet-macos
-          path: dist/Komet-macos.zip
+          path: dist/*.dmg
           if-no-files-found: error
           retention-days: 30