[MostlyArmless]

Description of changes

The existing macOS job builds on an Apple Silicon runner, but installer creation requires release signing and notarization secrets. Add a manual Apple Silicon DMG workflow that builds and tests natively on macos-15 and uploads a self-contained ARM64 DMG without those secrets.

• Explicitly set CMAKE_OSX_ARCHITECTURES=arm64 in both the existing ARM macOS job and the new workflow.
• Bundle dependencies with macdeployqt, verify ARM64 support in every bundled Mach-O binary, and reject dependencies pointing to Homebrew or the runner's home directory.
• Apply and verify an ad-hoc signature, then check that the deployed executable launches with --version before creating the DMG.
• Document local ARM64 builds and the manual workflow, including the macOS 15 minimum and the initial Open Anyway step for an unnotarized build.

The new workflow runs only via workflow_dispatch and has read-only repository permissions. Existing CI triggers, other platform jobs, and signed release packaging are unchanged. This PR is independent of the playback cursor feature in #578.

Validation

• The same build, test, deployment, architecture, signature, and DMG packaging commands passed on a native GitHub ARM64 runner: successful run. The executable steps in the new workflow match that run's workflow; only its name, step label, and comments were generalized.
• The resulting application was installed and verified on an M4 MacBook.
• The new workflow passes actionlint; the packaging script passes bash -n; git diff --check passes.
• The modified existing workflow has no new lint diagnostics. Its pre-existing runner.workspace expression warnings are also present on the upstream base.