fix(fonts): decode hdiutil plist output; gate snapshots on font portability

extractDmgFonts never extracted anything since spawnWithDeadline started
returning stdout as an ArrayBuffer: runCapture stringified it to
"[object ArrayBuffer]", so zero mount points parsed, every DMG yielded
no fonts (and leaked its mount), and snapshots shipped font catalogs
whose rows point at the BUILD host's /Library/Fonts — dead paths on any
consumer. That is exactly what the public instance has been serving.

Decode the buffer, hard-fail on zero parsed mount points, and add a
shared pre-publish gate (enforceFontPortability) to both the CI
orchestrator and the beta publish script: purge rows outside dataDir and
refuse to ship unless every family keeps an on-disk in-corpus file. The
beta script now also sets APPLE_DOCS_DOWNLOAD_FONTS=1 for its resources
refresh and mirrors CI's 1.9 GiB asset-size guard.