Fix bluebuild: move gguf-guard to optional binaries

gguf-guard is built from an external upstream (not in-repo) that is
still PENDING. The build correctly skips it when the source is
unavailable, but the final verification step listed it as required,
causing the build to abort.

Moved to OPTIONAL_BINARIES — warns but does not fail the build.
All 14 required binaries (9 Go services + securectl + llama-server +
quarantine-watcher + agent + ui) are verified as before.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: SecAI-Hub

files/scripts/build-services.sh

@@ -496,10 +496,14 @@ REQUIRED_BINARIES=(
     "${INSTALL_DIR}/agent"
     "${INSTALL_DIR}/ui"
     "/usr/local/bin/securectl"
-    "/usr/local/bin/gguf-guard"
     "/usr/bin/llama-server"
 )
 
+# Optional binaries — built from external upstreams, may be skipped
+OPTIONAL_BINARIES=(
+    "/usr/local/bin/gguf-guard"
+)
+
 MISSING=0
 for bin in "${REQUIRED_BINARIES[@]}"; do
     if [ -f "$bin" ]; then
@@ -517,6 +521,16 @@ if [ "$MISSING" -gt 0 ]; then
 fi
 echo "All ${#REQUIRED_BINARIES[@]} required binaries verified."
 
+# Check optional binaries (warn but don't fail)
+for bin in "${OPTIONAL_BINARIES[@]}"; do
+    if [ -f "$bin" ]; then
+        SIZE=$(stat -c%s "$bin" 2>/dev/null || stat -f%z "$bin" 2>/dev/null || echo "?")
+        printf "  OPTIONAL: %-45s %s bytes\n" "$bin" "$SIZE"
+    else
+        printf "  OPTIONAL MISSING: %s (upstream not pinned)\n" "$bin"
+    fi
+done
+
 # ---------------------------------------------------------------------------
 # Configure container signing policy for cosign-verified SecAI images.
 # ---------------------------------------------------------------------------