Disambiguate codesign identity in repack-dmg.sh (#7)

The v0.2.0 third-attempt run (24573078620) got all the way through macOS
signing + notarization + DMG creation, then died re-signing the DMG
wrapper inside create-dmg:

  ***: ambiguous (matches "iPhone Distribution: ***" and
                  "Developer ID Application: ***" in
                  /Users/runner/work/_temp/skiller-build.keychain-db)

The GitHub Actions macOS runner keychain happens to also have an
"iPhone Distribution" cert, and the bare CSC_NAME value (which is the
post-prefix identity name only) matches both. electron-builder itself
filters by identity *type* internally so it didn't care; /usr/bin/codesign
has no such filter.

Fix: prepend `Developer ID Application: ` back when calling create-dmg's
`--codesign`. Strip first so the operation is idempotent whether CSC_NAME
is stored in bare form (new convention) or with prefix (legacy local .env).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: beautyfree

scripts/repack-dmg.sh

@@ -52,7 +52,14 @@ trap 'rm -rf "$STAGING"' EXIT
 
 CODESIGN_ARGS=()
 if [[ -n "${CSC_NAME:-}" ]]; then
-	CODESIGN_ARGS=(--codesign "$CSC_NAME")
+	# electron-builder 26+ wants CSC_NAME without the "Developer ID Application: "
+	# prefix (it matches the cert type itself). /usr/bin/codesign has no such
+	# filter — if the keychain has multiple identities (e.g. iPhone Distribution
+	# + Developer ID Application), a bare name like "Your Name (TEAMID)" is
+	# ambiguous. Prepend the prefix back here. Idempotent: strip first in case
+	# CSC_NAME already has the full form (local dev habit).
+	IDENTITY="${CSC_NAME#Developer ID Application: }"
+	CODESIGN_ARGS=(--codesign "Developer ID Application: $IDENTITY")
 fi
 
 echo "Repackaging DMG with styled layout…"