"Identical" DMGs: one installs, one does not
There is information in extended attributes.

What is the setting in Preferences/Security &amp; Privacy/General "Allow apps⋯"?

This needs to be set to an appropriate value to allow non-App Store apps to be opened.