If you want, I can outline exact terminal commands to inspect the .dmg safely in a macOS VM, or help draft a checklist for verifying its integrity.