[datlechin]

Summary

• The disk image opens to a fixed Finder window: TablePro on the left, the Applications folder on the right, 128 pt icons, no toolbar, sidebar or status bar. Before, it opened in the Mac's default view with Applications sorted first, so the drag ran right to left.
• apple/scripts/release/dmg.sh build makes it with stock tools only. diskutil formats a blank image as HFS+, which Apple DTS recommends for a laid-out volume and diskutil image cannot create directly. The volume is filled while mounted, .fseventsd is removed, and the image is converted to read-only ULFO. diskutil image create from <folder>, which package.sh used, leaves .DS_Store out, so the old path could never carry a layout.
• The layout, apple/scripts/release/dmg.DS_Store, is a file Finder wrote. dmg.sh layout regenerates it on a maintainer's Mac and writes the same bytes each run; CI never drives Finder. It sets no background picture, so the window follows Light and Dark, and holds no alias, so it works under any mount name.
• The volume is named TablePro instead of TablePro <version>. The file keeps its TablePro-<version>.dmg name, so the cask, the website and the docs are unaffected.
• The volume icon is the app's own icon, taken from the built Assets.car with iconutil. The custom-icon flag is set through com.apple.FinderInfo, the way Apple DTS documents.
• package.sh signs the image with --identifier com.TablePro.dmg, as Apple's "Packaging Mac software for distribution" asks.
• dmg.sh checks every image it builds: HFS+, the volume name, exactly four items, the committed .DS_Store, the volume icon flag, and an app identical to the one built.
• The detector's release suite now watches dmg.sh and dmg.DS_Store, and apple/CONTRIBUTING.md says how to change the layout.

Before (0.83.1)	After

Test plan

• VERSION=0.0.0-dev scripts/release/package.sh app --unsigned on macOS 27.0.1 with a copy of TablePro 0.83.1: every check passes, and the image opens to the window above.
• A build that fails while the volume is mounted (an app with no Assets.car) leaves nothing attached.
• dmg.sh layout run twice writes the same bytes.
• codesign --sign - --identifier com.TablePro.dmg on the image, then codesign -dv, prints Identifier=com.TablePro.dmg.
• python3 -m unittest discover -s scripts/ci -p test_detect_changed_paths.py passes with the two new paths in the release case.
• Release Build dispatched on this branch builds and packages on the xcode-27 runner.
• Not checked: Dark Mode by eye, and macOS 13 to 15.