Fix relinking in make_dmg.sh
c432ef98c4cf3b2bda32734983eec3b42b8c3d1e completely broke the relinking
of libraries using install_name_tool by only doing it for the x86_64
part of the binaries. This commit fixes that, and also does some
tidy up that happened while trying to debug the error.
The main cleanup is that --deep is no longer used with codesign, rather
we sign all the executables ourselves manually. Various Apple forums
suggest that --deep is a Bad Idea for reasons that aren't really clear.
For reference, after spending days trying to debug the Gatekeeper
refusal to start DoM the way to reveal the problem was:
1. start a clean VM (there are caches everywhere, so once a failure has
happened you are even less likely to get any useful logging on the
second failure).
2. open "Console" on macOS; logs are written to un-greppable places so
you have to use this to see everything.
3. click "start streaming"; I don't know if this step is necessary.
4. put a search term in the search box (e.g. "dcp" for this)
5. start the thing that is not working.
And remember that otool without `-arch` on a fat binary will only really
operate / look at the first? native? architecture, so if you have
an x86_64/arm64 binary and the arm64 parts are wrong you won't see
anything about that with `otool -L`, only with `otool -arch arm64 -L`