fix(release): source the notarization library create-dmg.sh calls into

[datlechin]

v0.67.1 is blocked. Both Build arm64 and Build x86_64 fail in Package artifacts:

🔏 Signing DMG with: Developer ID Application: Dat Ngo Quoc (***)
✅ DMG signed
##[error]Process completed with exit code 127.

127 is "command not found". The command is notarize_and_staple, and I introduced the call in #2365 without the source line that defines it.

The app half of the same change worked, in the same job, a minute earlier:

📮 Notarizing...
TablePro-arm64.app notarized, stapled and accepted by Gatekeeper
✅ Notarization complete

How it got in

I inserted the source line into all three callers with a script that keyed on the shebang block:

if line.startswith('set -euo pipefail'):
    lines.insert(i + 1, LIB); break

build-release.sh and build-plugin.sh both open set -euo pipefail. create-dmg.sh opens set -e. No match, nothing inserted, and unlike the other two edits in that script I asserted nothing afterwards. The one-line fix is the source line.

Why nothing caught it

Every tool the repo runs was happy:

• bash -n parses the file fine; a call to an undefined function is valid syntax.
• shellcheck -x cannot tell a shell function from a command on PATH, so notarize_and_staple "$FINAL_DMG" open reads exactly like ditto or codesign.
• The macOS test job never runs create-dmg.sh.

Which leaves the release as the first thing to execute the line. That is the worst possible place to find out, so this PR also adds the check.

scripts/ci/check-lib-sourcing.py reads the function names each scripts/lib/*.sh defines and fails on any script that calls one without sourcing the library. It runs in repo-hygiene, on Linux, in well under a second.

Sourcing is resolved transitively, which is what makes it useful rather than noisy: macos.sh sources common.sh, so the five build scripts that source macos.sh and call run_quiet are correct, and an earlier version of this check reported all five. It matches the sourced file by basename so it works whether a script writes lib/common.sh or, as macos.sh does from inside lib/, just common.sh.

Mutation-tested against the actual bug:

fixed tree     exit=0  12 library functions, every caller sources its library.
broken tree    exit=1  scripts/create-dmg.sh:260: calls notarize_and_staple,
                       defined in lib/notarize.sh, without sourcing it

What this does not tell us

The DMG notarization path in #2365 has still never run. This fix gets it to the point of running; the next release tag is the first real exercise of it. Everything before that line in the job is known good: the app notarizes, staples and passes Gatekeeper through the same shared function, and the DMG is built and signed.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.