Hardening

[bniladridas]

Across these patches, we did two main things: repo cleanup and macOS release-build hardening.

For cleanup, we removed tracked residue that should not live in the repo: .harper/.harpertoken, xet/.DS_Store, and the tracked xet logs under xet/
logs. We tightened .gitignore so xet/, .cache/, outputs/, and .harper/.harpertoken stay out going forward, and we changed MANIFEST.in so source
distributions no longer include the whole .harper directory. We also reduced setup-doc duplication by removing QUICK_SETUP.asc, keeping
SETUP_GUIDE.asc as the single alias, and keeping AGENTS.asc as the canonical doc.

For release packaging, we rebuilt the DMGs locally and then fixed the repo so future DMG builds don’t depend on ignored local files. We added
scripts/build_macos_apps.sh as the tracked macOS app/DMG build entrypoint, added scripts/dmg_settings.py as a configurable dmgbuild settings file,
updated .github/workflows/release.yml to call that script, and kept an explicit unignore rule in .gitignore so the tracked settings file is not
swallowed by the broad dmg_settings.py ignore. That also removes the brittle dependency on osacompile and the ignored root-level packaging files for
release automation.

Everything was pushed to origin/main. The cleanup landed first, then the release-build fix landed after that.