ci: fix macOS codesign failure and nuget-publish skip on workflow_dispatch

[Marc-André Moreau (mamoreau-devolutions)]

What

Fixes two failures from run #35150675662 (Build Terminal, manual workflow_dispatch on master):

1. macOS sign and notarize osx-x64 / osx-arm64 failed

.../Devolutions Terminal.app/Contents/MacOS/Devolutions.Terminal: code object is not signed at all
In subcomponent: .../Devolutions Terminal.app/Contents/MacOS/THIRD-PARTY-NOTICES-GHOSTTY.txt
Exception: 'codesign ... Devolutions.Terminal' failed with exit code 1.

Stage-MacOsApp.ps1 copied the notices files into Contents/Resources but also left a duplicate copy sitting in Contents/MacOS, alongside the main executable. codesign, when given the path to the bundle's main executable, resolves and signs the whole app bundle, and treats stray non-executable files left in Contents/MacOS (a directory that's supposed to contain only executables/helper tools) as nested code requiring their own signature — which a plain .txt file obviously can't have, so signing failed.

Fix: Move-Item instead of Copy-Item for the notices files, so they only exist under Contents/Resources (matching Apple's bundle layout conventions). Updated Test-MacOsPackage.ps1's required-file check to match the new location.

2. Publish Devolutions.Terminal.Control to nuget.org was skipped

Its condition was:

if: ${{ needs.release-metadata.outputs.dry_run != 'true' && startsWith(github.ref, 'refs/tags/') }}

This run was a manual workflow_dispatch on master, so github.ref is refs/heads/master, never refs/tags/* — the job is unconditionally skipped for every workflow_dispatch run, dry-run or not. Every other release-type job (macos-sign, release) already uses the pattern github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/') to allow both triggers.

Fix: align nuget-publish's condition with that same pattern, so it runs for non-dry-run workflow_dispatch runs too, not just tag pushes.

Testing

• python -c "import yaml; yaml.safe_load(open('.github/workflows/build-terminal.yml'))" — YAML parses.
• PowerShell Parser.ParseFile on both edited scripts — no syntax errors.
• No macOS runner available locally to execute the actual codesign flow; the fix is scoped to removing the specific file layout that produced the documented codesign error and is consistent with the general macOS bundle-layout rule that Contents/MacOS should only contain executables.