Improve macOS DMG drag installation

[shaohaozhi286]

What changed

• style the macOS DMG as a branded left-to-right drag window
• keep the right-hand target as a signed current-user installer that writes only to ~/Applications/ACECode.app
• accept Finder drops only for the sibling ACECode.app, while preserving double-click installation
• generate a distinct installer ICNS from an editable SVG and add a custom mounted-volume icon
• build a writable intermediate image, persist Finder layout metadata, then convert and verify read-only UDZO output
• add portable contract coverage for layout assets, drag metadata, and no-admin constraints

Why

A conventional /Applications alias can require administrator access and violates ACECode's user-scoped installation contract. This keeps the familiar drag gesture while routing it through the existing safe installer.

Verification

• cmake --build build/macos-x64-desktop-release --target acecode-user-installer acecode-desktop --parallel 4
• bash tests/scripts/macos_dmg_layout_test.sh
• bash tests/scripts/macos_release_scripts_test.sh
• acecode_unit_tests --gtest_filter='UserInstallPolicy.*' (6 passed)
• npx --no-install openspec validate improve-macos-dmg-drag-install --strict
• locally created, verified, mounted, and visually inspected the DMG
• confirmed .DS_Store, branded background, installer icon, and volume icon are present
• confirmed the image contains no /Applications link