fix(desktop): isolate packaged sidecar resolution

[cmyk]

Summary

• identify packaged macOS execution structurally from the running executable under .app/Contents/MacOS
• resolve every configured Tauri sidecar from that directory first and exclusively
• fail closed when a packaged sidecar is absent instead of falling back to worktree target/debug or target/release
• preserve explicit development target fallback outside an app bundle

Why

The PR #11 staged app launched its buzz-desktop from the bundle but resolved buzz-acp from an existing source worktree. A packaged build must not infer development mode from ambient checkout paths on the build machine.

Verification

• packaged sidecar wins with populated debug and release targets
• missing packaged sidecar does not fall back
• explicit external sidecar path is ignored in packaged execution
• packaged bare custom command does not search worktree targets
• development release fallback remains allowed
• guarded sidecar names stay synchronized with bundle.externalBin
• full desktop library suite: 2392 passed, 0 failed, 14 ignored
• desktop file-size ratchet: passed
• git diff --check: passed
• Clippy with warnings denied: passed when allowing the unchanged main unused re-exports

just ci reaches the pre-existing Desktop Clippy failure for unused codex_version re-exports in discovery.rs; those lines are unchanged from main and are outside this narrow resolver fix.

[reinhold-ph]

APPROVE — no blocking findings in 898d562b01dda584ba42f6d6fb50c0ff7638f469...11c8fc17eb6b852546f4701f614568f10930d2db.

Independent review traced the complete packaged/development resolver control flow and all changed tests. Packaged execution is derived from the running .app, checks all configured Tauri sidecars before managed/PATH/cache fallbacks, resolves only the bundled executable, and fails closed when it is absent. Development fallback remains available outside an app bundle. DCO and git diff --check pass; no workflow, manifest, or lockfile changes are present.

The reviewer did not rerun Rust builds on the constrained Reinhold host. Executor evidence reports the full Desktop library suite (2,392 passed), file-size ratchet, and Clippy gate. Owner acceptance on the combined exact stack additionally proved that the live process selected Contents/MacOS/buzz-acp while both external debug and release binaries remained present, and that the bundled sidecar completed one first-attempt signed send with no DNS failure, elevated retry, or Guardian Review.