feat: switch to DMG distribution with stapled notarization ticket

Replace tar.gz/zip with DMG for release distribution. DMG supports
xcrun stapler staple, embedding the Apple notarization ticket directly
in the disk image for offline Gatekeeper verification.

Made-with: Cursor

Author: Vect0rM

.github/workflows/build-turboquant-macos.yml

@@ -125,7 +125,7 @@ jobs:
               --sign "$CODESIGN_IDENTITY" "$lib"
           done
 
-      - name: Prepare release archive
+      - name: Prepare release contents
         run: |
           mkdir -p release/build/bin
           cp build/bin/llama-server release/build/bin/
@@ -134,25 +134,31 @@ jobs:
           cp build/bin/llama-perplexity release/build/bin/ 2>/dev/null || true
           find build -name "*.dylib" -exec cp {} release/build/bin/ \; 2>/dev/null || true
           find build -name "*.metal" -path "*/bin/*" -exec cp {} release/build/bin/ \; 2>/dev/null || true
-          cd release
-          zip -r ../llama-turboquant-macos-arm64.zip .
-          tar -czf ../llama-turboquant-macos-arm64.tar.gz .
-          cd ..
-          ls -lh llama-turboquant-macos-arm64.zip llama-turboquant-macos-arm64.tar.gz
 
-      - name: Notarize release archive
+      - name: Create DMG
+        run: |
+          hdiutil create -volname "LlamaTurboQuant" \
+            -srcfolder release \
+            -ov -format UDZO \
+            llama-turboquant-macos-arm64.dmg
+          ls -lh llama-turboquant-macos-arm64.dmg
+
+      - name: Notarize DMG
         env:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: |
-          echo "Submitting for notarization..."
-          xcrun notarytool submit llama-turboquant-macos-arm64.zip \
+          echo "Submitting DMG for notarization..."
+          xcrun notarytool submit llama-turboquant-macos-arm64.dmg \
             --apple-id "$APPLE_ID" \
             --password "$APPLE_ID_PASSWORD" \
             --team-id "$APPLE_TEAM_ID" \
             --wait --timeout 10m
-          echo "Notarization complete"
+          echo "Stapling notarization ticket to DMG..."
+          xcrun stapler staple llama-turboquant-macos-arm64.dmg
+          echo "Verifying staple..."
+          xcrun stapler validate llama-turboquant-macos-arm64.dmg
 
       - name: Clean up keychain
         if: always()
@@ -184,15 +190,18 @@ jobs:
 
             ### Usage
             ```bash
-            tar -xzf llama-turboquant-macos-arm64.tar.gz
-            ./build/bin/llama-server -m model.gguf --cache-type-k turbo3 --cache-type-v turbo3
+            # Mount the DMG, then copy binaries:
+            hdiutil attach llama-turboquant-macos-arm64.dmg
+            cp -R /Volumes/LlamaTurboQuant/build/bin/ ./llama-bin/
+            hdiutil detach /Volumes/LlamaTurboQuant
+            ./llama-bin/llama-server -m model.gguf --cache-type-k turbo3 --cache-type-v turbo3
             ```
 
             ### For Atomic Chat integration
             Replace the binary at:
             ```
             ~/Library/Application Support/Atomic Chat/data/llamacpp/backends/<version>/macos-arm64/build/bin/llama-server
             ```
-          files: llama-turboquant-macos-arm64.tar.gz
+          files: llama-turboquant-macos-arm64.dmg
           draft: false
           prerelease: true