Publish scoped helper packages for appdmg release chain

[jozefizso]

Goal

Publish or verify npm availability for the scoped packages needed before the first @appdmg/appdmg and @appdmg/cli releases can be validated from a clean install.

Requirements

• Verify npm auth for an account allowed to publish under the @appdmg scope.
• Publish or verify registry availability for @appdmg/bplist-creator, @appdmg/tn1150, @appdmg/macos-alias, and @appdmg/ds-store at the intended versions.
• Confirm @appdmg/appdmg resolves its scoped runtime dependencies from npm, not only GitHub tarballs or local paths.
• Confirm @appdmg/cli installs from a clean package with its exact @appdmg/appdmg dependency.
• Record the exact versions and dependency ranges used for the v1.0.0 release chain.

Current blocker

On 2026-04-30, local verification could not publish or inspect private auth because npm auth is unavailable from this machine:

• npm whoami: E401 Unauthorized
• @appdmg/bplist-creator: E404 on npm
• @appdmg/tn1150: E404 on npm
• @appdmg/ds-store: E404 on npm
• @appdmg/appdmg: E404 on npm
• @appdmg/cli: E404 on npm
• @appdmg/macos-alias is visible as 2.0.0, but the Node.js 24 modernization needs the intended release version to be verified before final publication.

Acceptance criteria

• A clean npm install can resolve the full @appdmg release chain.
• npm package metadata and versions are recorded in the release notes.
• The final CLI package can be packed and installed without GitHub tarball dependencies.

[jozefizso]

Publish workflow infrastructure is now merged across the release chain:

• Add npm provenance publish workflow bplist-creator#5 -> 16c256e
• Add npm provenance publish workflow tn1150#2 -> 5c8b9a
• Add npm provenance publish workflow macos-alias#24 -> 16272bd
• Add npm provenance publish workflow ds-store#3 -> efe60a9
• Add npm provenance publish workflow #17 -> 20d8b8a

Each workflow runs from GitHub Actions release events, uses Node.js 24, grants id-token permissions, packs the exact npm tarball, creates a GitHub artifact attestation for that tarball, uploads it as a workflow artifact, and publishes the same tarball with npm publish --provenance --access public.

Remaining setup before release: configure npm Trusted Publishers for each package using workflow filename publish.yml and no environment name. If npm cannot configure Trusted Publishing before a first publish for a new package, add a granular NPM_TOKEN repository secret temporarily; the workflows still publish from Actions with provenance enabled. Release order remains bottom-up: bplist-creator, tn1150, macos-alias, ds-store, then appdmg/appdmg-cli.