Modernize ds-store for Node.js 24

[jozefizso]

Summary

Modernizes ds-store into the scoped @appdmg/ds-store package for the Node.js 24 appdmg stack.

• renames package metadata to @appdmg/ds-store@1.0.0 with Node >=24
• switches runtime helpers to @appdmg/bplist-creator, @appdmg/macos-alias, and @appdmg/tn1150
• keeps CommonJS and the existing callback API, while adding promise-based write() support
• replaces deprecated new Buffer() usage in active code paths
• adds AVA characterization tests for generated Finder metadata and background aliases
• adds a Node 24 CI workflow for Ubuntu and macOS
• documents the scoped package API and non-Darwin background alias option

The public dependency contract in package.json uses patch-line semver ranges. Because the scoped helper packages are merged but not published to npm yet, package-lock.json pins their current GitHub tarballs so CI can install reproducibly before the npm release-chain task completes.

Verification

• npm ci
• npm test
• npm audit --audit-level=moderate
• npm ls --omit=dev --all
• npm pack --dry-run
• node --check index.js
• node --check lib/buddy-allocator.js
• node --check lib/ds-store.js
• node --check lib/entry.js
• node --check lib/partition.js
• node --check test/ds-store.js
• node --check test/entry.js
• workflow YAML parse

Closes #1

[jozefizso]

CI status update: Ubuntu passed, macos-15-intel exposed a helper bug in @appdmg/macos-alias when APFS inode IDs exceed uint32 during alias creation. I am fixing macos-alias first, then I will update this PR lockfile to the fixed helper commit and rerun CI.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 450c144253

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Publish installable dependency sources

These runtime dependencies now point to plain semver ranges, but the tested artifacts are GitHub tarballs pinned only in package-lock.json; when @appdmg/ds-store is installed as a dependency, npm ignores this package’s lockfile and resolves from the registry. That means downstream installs can fail (if these scoped versions are not yet published) or silently pull different code than CI validated, so consumers may not be able to install or reproduce the release.

Useful? React with 👍 / 👎.