macos_sign.sh: shrink signed DMG before conversion (#3649)

Without the final shrinking pass, diskutil verifyVolume errors with "Invalid
number of allocation blocks", which causes issues for non-interactive mounting
in package managers.

scripts/macos_sign.sh

@@ -108,9 +108,17 @@ resign_dmg() {
 	notarize_bundle Cutter-rw/Cutter.app
 	unmount
 	trap - EXIT
+	# Remove temporary signing space and restore HFS+ volume consistency.
+	ee hdiutil resize -size min Cutter-rw.dmg
 	OUTPUT="${1%.*}-signed.dmg"
 	echo_step "Creating final read-only ${OUTPUT}"
 	ee hdiutil convert -format UDZO -o "${OUTPUT}" Cutter-rw.dmg
+	echo_step "Verifying filesystem in ${OUTPUT}"
+	ee hdiutil attach "${OUTPUT}" -readonly -nobrowse -noautofsck -mountpoint Cutter-rw
+	trap unmount EXIT
+	ee diskutil verifyVolume Cutter-rw
+	unmount
+	trap - EXIT
 }
 
 case "$1" in