ci: validate embedded-cli bundle build on macOS / Linux / Windows

The default `cargo test` job in rust-sdk-tests.yml runs on all three
supported platforms but does not set `COPILOT_CLI_VERSION` — which
means `build.rs` short-circuits immediately and the embedded-cli
bundle path (download + SHA-256 verify + extract + zstd compress +
embed) is never exercised in CI. After the recent switch from
shelling out to `curl` over to `ureq` with retry logic in
`build.rs`, that gap matters: the new HTTP client + cross-platform
TLS code path needs cross-platform CI coverage before it ships.

Adds a parallel `bundle` job to the same workflow:

- 3-OS matrix: ubuntu-latest, macos-latest, windows-latest.
- Reads the pinned CLI version from `nodejs/package.json` so the
  bundle test always tracks the same version the rest of the SDK
  ships against — no separate version source to drift.
- Caches the downloaded archive in `./rust/.bundled-cli-cache` keyed
  on OS + CLI version, so steady-state CI doesn't refetch ~130 MB
  on every run. Cache miss (e.g. first run after a CLI bump)
  exercises the full download path end-to-end, which is the
  regression surface this job is meant to catch.
- Runs `cargo build --features embedded-cli` to drive `build.rs`
  through the full pipeline. Doesn't run `cargo test` — the test
  job already covers runtime behavior; this job is specifically
  validating the bundle build.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: tclem

.github/workflows/rust-sdk-tests.yml

@@ -110,3 +110,61 @@ jobs:
           package: github-copilot-sdk
           manifest-path: rust/Cargo.toml
 
+  # Validates the `embedded-cli` build path on all three supported
+  # platforms. This is the only place `build.rs` actually runs (the
+  # default `cargo test` job above has `COPILOT_CLI_VERSION` unset, so
+  # `build.rs` returns immediately). Catches regressions in the
+  # download / verify / extract / embed pipeline before they ship to
+  # crates.io and before bundling consumers (e.g. github-app's
+  # bundled-CLI release pipeline) hit them downstream.
+  bundle:
+    name: "Rust SDK Bundled CLI Build"
+    env:
+      CARGO_TERM_COLOR: always
+      RUST_BACKTRACE: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: ./rust
+    steps:
+      - uses: actions/checkout@v6.0.2
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.94.0"
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: "rust"
+          key: bundled-cli
+
+      - name: Read pinned @github/copilot CLI version
+        id: cli-version
+        working-directory: ./nodejs
+        run: |
+          version=$(node -p "require('./package.json').dependencies['@github/copilot'].replace(/^[\^~]/, '')")
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "Pinned CLI version: $version"
+
+      # Cache the downloaded archive across runs so we don't refetch
+      # ~130 MB on every CI invocation. Keyed by OS + CLI version; on
+      # cache miss the bundle job exercises the full ureq download +
+      # SHA-256 + retry path, which is exactly the regression surface
+      # we want validated.
+      - name: Cache bundled CLI tarball
+        uses: actions/cache@v4
+        with:
+          path: ./rust/.bundled-cli-cache
+          key: bundled-cli-${{ matrix.os }}-${{ steps.cli-version.outputs.version }}
+
+      - name: cargo build --features embedded-cli
+        env:
+          COPILOT_CLI_VERSION: ${{ steps.cli-version.outputs.version }}
+          BUNDLED_CLI_CACHE_DIR: ${{ github.workspace }}/rust/.bundled-cli-cache
+        run: cargo build --features embedded-cli