Fix relinking in make_dmg.sh

Fix relinking in make_dmg.sh

c432ef98c4cf3b2bda32734983eec3b42b8c3d1e completely broke the relinking
of libraries using install_name_tool by only doing it for the x86_64
part of the binaries.  This commit fixes that, and also does some
tidy up that happened while trying to debug the error.

The main cleanup is that --deep is no longer used with codesign, rather
we sign all the executables ourselves manually.  Various Apple forums
suggest that --deep is a Bad Idea for reasons that aren't really clear.

For reference, after spending days trying to debug the Gatekeeper
refusal to start DoM the way to reveal the problem was:

1. start a clean VM (there are caches everywhere, so once a failure has
   happened you are even less likely to get any useful logging on the
   second failure).

2. open "Console" on macOS; logs are written to un-greppable places so
   you have to use this to see everything.

3. click "start streaming"; I don't know if this step is necessary.

4. put a search term in the search box (e.g. "dcp" for this)

5. start the thing that is not working.

And remember that otool without `-arch` on a fat binary will only really
operate / look at the first? native? architecture, so if you have
an x86_64/arm64 binary and the 	arm64 parts are wrong you won't see
anything about that with `otool -L`, only with `otool -arch arm64 -L`