fix(release): ship claude sidecar as resource, not externalBin

Bun-compiled binaries (~100MB) have an unusual ELF layout: the dynamic
section sits at offset 96MB, after Bun's appended JS payload. patchelf,
which linuxdeploy invokes during AppImage bundling to set rpath on
every ELF in usr/bin/, corrupts the binary when it tries to relocate
that dynamic section. The corruption only manifests on the gtk plugin's
recursive linuxdeploy pass: ldd then fails on the corrupted binary,
linuxdeploy throws std::runtime_error, and the AppImage build aborts:

  [gtk/stderr] terminate called after throwing an instance of 'std::runtime_error'
  [gtk/stderr]   what():  Failed to run ldd: exited with code 1

agent-browser (8MB, normal layout) survives the same patchelf step
with only a warning, which is why it's been shipping fine.

Move the sidecar from externalBin (usr/bin/) to resources (usr/share/),
which linuxdeploy does not scan. Update setup() to resolve the bundled
path via AppHandle::path().resource_dir() and pin it via
CODEMUX_CLAUDE_SIDECAR_PATH so the adapter (which has no AppHandle
access) can find it.

Author: Zeus-Deus

src-tauri/src/lib.rs

@@ -518,6 +518,38 @@ pub fn run() {
 
             control::spawn_control_server(app.handle().clone());
 
+            // Resolve the bundled claude-agent sidecar from Tauri's resource
+            // dir and pin the path via env var so the adapter (which has no
+            // AppHandle access at construction time) can find it. Only one
+            // file matches the `codemux-claude-sidecar-*` glob in resources/
+            // — the per-target binary staged by scripts/build-claude-sidecar.sh
+            // for whichever triple this build was compiled against.
+            //
+            // The bun --compile binary is huge (~100 MB) with the dynamic
+            // section at offset 96 MB, which patchelf corrupts when run by
+            // linuxdeploy during AppImage bundling. Shipping it as a resource
+            // (usr/share/...) instead of an externalBin (usr/bin/) keeps it
+            // out of linuxdeploy's scan path. See `tauri.conf.json` for the
+            // mirror change.
+            if let Ok(resource_dir) = app.handle().path().resource_dir() {
+                let triple = agent_provider::claude::sidecar_path::target_triple();
+                let ext = if cfg!(windows) { ".exe" } else { "" };
+                let sidecar = resource_dir
+                    .join("binaries")
+                    .join(format!("codemux-claude-sidecar-{triple}{ext}"));
+                if sidecar.exists()
+                    && std::env::var(
+                        agent_provider::claude::sidecar_path::SIDECAR_PATH_ENV,
+                    )
+                    .is_err()
+                {
+                    std::env::set_var(
+                        agent_provider::claude::sidecar_path::SIDECAR_PATH_ENV,
+                        sidecar,
+                    );
+                }
+            }
+
             // Agent-chat provider registry initialisation.
             //
             // When `enable_agent_chat` is on, spawn concrete Claude /

src-tauri/tauri.conf.json

@@ -30,8 +30,10 @@
     "createUpdaterArtifacts": true,
     "targets": "all",
     "externalBin": [
-      "binaries/agent-browser",
-      "binaries/codemux-claude-sidecar"
+      "binaries/agent-browser"
+    ],
+    "resources": [
+      "binaries/codemux-claude-sidecar-*"
     ],
     "linux": {
       "deb": {