Cross-build on one runner, keep a thin OS-only job

A modern desktop packager can cross-build: from a Linux runner it produces the Linux tree, both macOS architectures and the Windows package, all in one pass. Use that. Fanning out to three OS-matrixed jobs means three checkouts, three dependency resolutions and three compiles for artifacts that a single job already produced.

But some steps are genuinely OS-bound. Wrapping a macOS app into a disk image is one: the image tools ship only with macOS. So the pipeline is one heavy cross-build job plus one thin OS-only job:

jobs:
  build-desktop-packages:
    runs-on: ubuntu-22.04          # cross-builds Linux + both macOS arches + Windows
  wrap-mac-dmg:
    runs-on: macos-14
    needs: build-desktop-packages  # unpacks the mac archives, wraps each into a disk image