sign the app instead of the dmg, maybe that'll let it at least open without removing the quarantined attribute

.github/workflows/build-macos.yml

@@ -75,6 +75,7 @@ jobs:
           unzip *.zip
           lipo {.,x86_64}/melonDS.app/Contents/MacOS/melonDS -create -output melonDS
           cp melonDS melonDS.app/Contents/MacOS/melonDS
+          codesign -s - --deep melonDS.app
       - name: Create disk image
         shell: bash
         run: |
@@ -82,7 +83,6 @@ jobs:
           ln -s /Applications app/Applications
           mv melonDS.app app
           hdiutil create -fs HFS+ -volname melonDS -srcfolder app -ov -format UDBZ melonDS.dmg
-          codesign -s - --deep melonDS.dmg
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with: