Detect application is being run from the .dmg
And prevent it. Either that, or make add-ons like ctypes-otr install in profiles that are created from there.
We mention this in the instructions, https://trac.torproject.org/projects/tor/wiki/doc/TorMessenger#Instructions
On OS X, copy the Tor Messenger application from the disk image to your local disk before running it.
but it's a currently a pretty terrible failure mode.