Add @appdmg/cli package

[jozefizso]

Summary

Adds the first-stage @appdmg/cli package with the new appdmg-cli executable.

• creates packages/cli as a separate Node.js 24 CommonJS package
• exposes only the appdmg-cli bin, with no appdmg compatibility alias
• keeps the user-facing positional contract: <json-path> <dmg-path>
• uses node:util.parseArgs
• writes human output to stderr and nothing to stdout
• implements --help, --version, --quiet, and --verbose
• makes verbose output win over quiet on failures
• depends on @appdmg/appdmg with exact version 1.0.0
• extends CI to test both the library package and CLI package on Node 24 across Ubuntu and macOS

The CLI package lock pins the merged GitHub tarballs for @appdmg/appdmg and helper packages until the scoped npm release-chain task publishes them.

Verification

Library package:

• npm ci
• npm test
• npm audit --audit-level=moderate
• npm ls --omit=dev --all
• npm pack --dry-run
• node --check ... for library sources/tests

CLI package:

• npm ci
• npm test
• npm audit --audit-level=moderate
• npm ls --omit=dev --all
• npm pack --dry-run
• node --check bin/appdmg-cli.js
• node --check lib/args.js
• node --check lib/main.js
• node --check lib/render-progress.js
• node --check test/args.test.js
• node --check test/main.test.js

Closes #7

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fc8e9088ee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Separate verbose errors from quiet progress/success output

--verbose is documented as controlling error detail, while --quiet is documented to suppress progress/success/error output; however, shouldWrite is computed as !options.quiet || options.verbose and reused for progress and success paths, so --quiet --verbose on a successful run still emits progress and completion text. This breaks the stated CLI behavior for users who want quiet successful runs but verbose failure diagnostics.

Useful? React with 👍 / 👎.