ci(desktop): skip unused DMGs for signing-input builds

[Rinat S (rsolmano)]

Summary

Avoid creating the unsigned macOS DMG that the private release pipeline discards. The triggering nightly failed in that redundant framework hdiutil create step with Resource busy before signing or publication.

• Add opt-in macos-signing-input-only to the public build action, restricted to macOS ARM64.
• Select Electrobun's documented build.mac.createDmg: false through an explicit build-only environment value, without changing the normal package commands or SDK.
• Return the mandatory expanded app and updater pair with empty installer outputs in that mode. Default local/CI installers remain unchanged.
• Skip only the nonexistent unsigned-DMG installer smoke in that opt-in path; expanded-app smoke and private final signed-installer verification remain mandatory.

Companion private workflow: https://github.com/JetBrains/thinkrail-signing/pull/9

Related issues

None.

Checklist

• Fast gates pass: bun run lint, bun run typecheck, bun run test
• E2E suite passes for app-affecting changes (bun run e2e, or bun run e2e:full when touching agent behavior)
• Relevant SPEC.md / top-level specs updated to reflect any boundary, contract, or behavior change
• I have read the Contributing guide and agree to the Code of Conduct

Verification

Using repository-pinned Bun 1.4.0:

• bun test apps/desktop/src/buildConfig.test.ts packages/artifact-tests/src/releaseArtifacts.test.ts — 33 passed, including default and input-only paths, target/value rejection, mandatory outputs and smoke gating.
• bun run check:deps, check:boundaries, check:seams, check:spec-surface — passed.
• bun run lint — passed with six pre-existing unused-suppression warnings; no new suppressions.
• bun run typecheck and bun run test — all 15 workspace tasks passed.
• bun run e2e — the initial complete run passed all 389 tests. After rebasing onto 2f16bd63, the complete rerun was 388 passed / 1 failed at e2e/chat-order.spec.ts:117 (scroll-to-top, assertion at line 204). This is the same previously established local baseline flake; chat/test sources are outside this diff, and no test was skipped or weakened. The E2E checkbox awaits an observed CI pass for the submitted head.
• Real THINKRAIL_MACOS_SIGNING_INPUT_ONLY=true bun run --cwd apps/desktop package:canary in a fresh disposable worktree — passed; produced the exact macOS manifest and app archive, and no DMG. This was a build-only probe, not signed-install qualification.
• git diff --check — passed. Spec validation retains three unrelated pre-existing dangling task links.
• Cross-repository claude-opus-5 review — Approve; both non-blocking cleanup suggestions were addressed (collector-owned smoke gating and explicit test-module ownership).

Rollout and scope

Merge the private consumer first, then this public producer. Older sources may still create an unused DMG; the updated private handoff ignores it. No runtime updater changes, new dependencies, SDK patches, global cleanup or security-service changes.

Nightly .47 completed successfully using its original commits, independently of this draft. The owning spec's obsolete pre-launch feed statement is now removed; installed A→B qualification remains separate and required before stable enablement. No installed application was replaced or restarted by this follow-up.