Auto-bump README DMG link on app releases

[bootuz]

Summary

Each `app-v*` tag now bumps the README's DMG download link to the freshly-released version automatically. No more hand-editing the link on every release.

How it works

A marker block in the README:

```html

Download the latest DMG: Keywordista-X.Y.Z.dmg (signed + notarized). …

```

After the `Create GitHub Release` step lands the DMG + checksum, a new `Bump README DMG link to this release` step:

1. Switches from the tag-detached HEAD to a fresh `main`.
2. Splices the canonical block between the LATEST_DMG markers via `awk` (portable across BSD and GNU; sed's multi-line handling differs).
3. Commits + pushes to `main` as `github-actions[bot]`. Idempotent — if the block already matches the released version (re-runs, manual triggers, etc.), no commit lands.

The PR also restores the DMG section to the README's Install block (pointing at the current 0.1.0 release) so the marker block has a body to operate on — and so the public README has a usable download link from day one.

Safety

• Manual dry runs are noop on main. The step is gated on `github.event_name == 'push'`; `workflow_dispatch` exercises the build but not the README bump.
• No CI feedback loop. The bot commit only touches `README.md`, which matches the `paths-ignore: '**/*.md'` rule landed in PR Skip CI on docs-only / gitignore-only changes #3. `[skip ci]` in the commit message is belt-and-suspenders.
• Idempotent. Verified locally with both v0.2.0 (new version → splices correctly) and v0.1.0 (existing version → `diff` produces no output → exit 0 with no commit).
• `contents: write` permission already on the job (used by `gh release create`).

Test plan

• Reviewer: merge this, then cut `app-v0.2.0` (or higher) as a test. Expect the workflow to land a follow-up commit on `main` titled `README: bump DMG download link to v0.2.0 [skip ci]`, and the README link in the diff to swap from `app-v0.1.0` to `app-v0.2.0`.
• Local awk smoke test: `VERSION=0.2.0` produces the expected splice; `VERSION=0.1.0` (current state) produces an identical file → no-op commit.