fix(desktop): preserve packaged CLI and assemble universal sidecar

[lidge-jun]

Summary

• Repair two desktop packaging failures observed in preview dry-run 35718064920: linuxdeploy rewrites the compiled Bun sidecar before its GTK pass fails ldd, and the universal macOS bundle lacks its universal sidecar filename.
• Preserve only the exact, byte-identical Linux ocx sidecar during RPATH rewriting, delegate other ELF operations normally, and require extracted AppImage CLI byte equality plus a bounded version probe before collecting assets. Combine both prepared macOS CLI slices with lipo and require both architectures.
• Maintainer integration into dev is explicitly authorized immediately without waiting for CI. This is not a CI-pass claim; publication still requires the canonical checks, asset verification and signatures.

Verification

• Hosted failure evidence: Linux job 106714839327, macOS job 106714839349. Windows MSI and all five standalone packages passed in the same dry-run.
• Independent Sol source and security review covers the narrow wrapper, platform conditions, artifact checks and unchanged signing/publication boundaries.
• Added workflow wiring assertions. The next hosted release dry-run exercises the actual packaged binaries.
• Local tests, typechecks, builds and runtime probes: NOT RUN, as explicitly required by the owner. Commit and push use --no-verify.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d13b8ad1-536b-4f65-93f6-93121e06628c

📥 Commits

Reviewing files that changed from the base of the PR and between 482a3e0 and 991349f.

📒 Files selected for processing (5)

• .github/workflows/release.yml
• desktop/scripts/appimage-patchelf.py
• desktop/scripts/verify-linux-sidecar.sh
• structure/desktop-shell.md
• tests/ci-workflows/release-desktop-scripts.test.ts

 __________________________________________________________________________________________________________________________________________
< Test early. Test often. Test automatically. Tests that run with every build are much more effective than test plans that sit on a shelf. >
 ------------------------------------------------------------------------------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}