ci(macos): la entrega vuelve a publicar el paquete de macOS

.github/workflows/build.yml

@@ -242,16 +242,48 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+  # El .dmg de Apple Silicon compila su propia .dylib, como el instalador de Windows (ADR-0040).
+  macos:
+    name: DMG de macOS
+    runs-on: macos-14
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.ref }}
+
+      - uses: ./.github/actions/setup-runner
+        with:
+          rust: release
+          node: true
+          java: graalvm
+          save-cache: false
+
+      - name: Libreria nativa
+        run: just native
+
+      - name: Empaqueta la .app y el .dmg
+        run: just bundle
+
+      - name: Sube el .dmg
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bundle-macos
+          path: rfirma-app/src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/*.dmg
+          if-no-files-found: error
+          retention-days: 1
+
   collect-packages:
     name: Reune y verifica paquetes
-    needs: [native-bridge, test-native, flatpak, bundle, windows]
+    needs: [native-bridge, test-native, flatpak, bundle, windows, macos]
     if: |
       always() &&
       !cancelled() &&
       needs.native-bridge.result == 'success' &&
       needs.test-native.result == 'success' &&
       needs.flatpak.result == 'success' &&
       needs.windows.result == 'success' &&
+      needs.macos.result == 'success' &&
       (needs.bundle.result == 'success' || needs.bundle.result == 'skipped')
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -285,6 +317,12 @@ jobs:
           name: bundle-windows
           path: ${{ runner.temp }}/paquetes
 
+      - name: Descarga el .dmg de macOS
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: bundle-macos
+          path: ${{ runner.temp }}/paquetes
+
       - name: Descarga bundles nativos (.deb y .rpm)
         if: needs.native-bridge.outputs.native-packages == 'true'
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

.github/workflows/warm-release-cache.yml

@@ -55,7 +55,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include: ${{ fromJSON(github.event.schedule == '37 2 * * *' && '[{"runner":"ubuntu-24.04","timeout":60,"apt":"tauri","java":"none","native":false,"recipe":"build-rust"}]' || github.event_name == 'schedule' && '[{"runner":"windows-latest","timeout":90,"apt":"none","java":"graalvm","native":true,"recipe":"bundle"}]' || '[{"runner":"ubuntu-24.04","timeout":60,"apt":"tauri","java":"none","native":false,"recipe":"build-rust"},{"runner":"windows-latest","timeout":90,"apt":"none","java":"graalvm","native":true,"recipe":"bundle"}]') }}
+        include: ${{ fromJSON(github.event.schedule == '37 2 * * *' && '[{"runner":"ubuntu-24.04","timeout":60,"apt":"tauri","java":"none","native":false,"recipe":"build-rust"}]' || github.event_name == 'schedule' && '[{"runner":"windows-latest","timeout":90,"apt":"none","java":"graalvm","native":true,"recipe":"bundle"},{"runner":"macos-14","timeout":90,"apt":"none","java":"graalvm","native":true,"recipe":"bundle"}]' || '[{"runner":"ubuntu-24.04","timeout":60,"apt":"tauri","java":"none","native":false,"recipe":"build-rust"},{"runner":"windows-latest","timeout":90,"apt":"none","java":"graalvm","native":true,"recipe":"bundle"},{"runner":"macos-14","timeout":90,"apt":"none","java":"graalvm","native":true,"recipe":"bundle"}]') }}
     runs-on: ${{ matrix.runner }}
     timeout-minutes: ${{ matrix.timeout }}
     defaults:

docs/adr/0040-macos-en-apple-silicon-como-tercera-plataforma.md

@@ -143,8 +143,7 @@ dependencia en todas las plataformas para algo que en Linux y Windows ya resuelv
 - El CI tiene un job `macos` en `platforms.yml` que compila la `.dylib`, pasa `rustfmt`, `clippy`
   y `just test-macos`. Corre en un PR solo si toca algo que solo compila macOS o que cambia cómo
   se compila allí, o lleva `ci-macos` o `ci-full`, y en `main` en la nocturna (ADR-0014).
-- El `.dmg` no se publica en la entrega: `build.yml` no lo construye mientras los adaptadores de
-  firma estén pendientes, porque un paquete que no puede firmar no sirve a quien lo descarga.
+  La entrega (`build.yml`) construye el `.dmg` con firma ad hoc y el *hardened runtime* desactivado.
 - `lib.rs` genera el contexto de Tauri una sola vez en `run` y `event_loop.rs` lo construye: en macOS `generate_context!()` define
   el `Info.plist` embebido, y llamarla dos veces falla al enlazar.
 - Los códigos con que macOS rechaza un certificado de sede no reconocido (ADR-0039) se añaden a