fix(dev): stage built desktop sidecars

[ugiya]

Summary

• stage freshly built debug sidecars into Tauri's target-specific externalBin paths before launching Desktop
• use Cargo metadata to locate the root target directory instead of relying on the caller's working directory
• validate that every source binary exists and is non-empty before replacing a stub
• preserve Windows .exe handling and the existing non-Windows Kubernetes sidecar rule

Problem

The Desktop recipes create target-named sidecar stubs so Tauri can validate externalBin, then build the real binaries in Cargo's root target directory. They did not copy those builds over the stubs before launch.

As a result, just dev and just desktop-standalone could launch stale sidecars left by an earlier build, or first-run placeholder files, even though Cargo had just produced fresh binaries.

Fix

Add _stage-debug-sidecars and call it immediately after the sidecar build in both native Desktop launch recipes. The recipe copies only the explicitly declared sidecars and marks them executable on non-Windows hosts. It does not broaden the child process PATH.

Verification

Exact pushed head: 650eb931a

• just _stage-debug-sidecars: passed
• byte comparison passed for all six macOS debug sidecars: buzz, buzz-acp, buzz-agent, buzz-dev-mcp, git-credential-nostr, and buzz-backend-kubernetes
• repository pre-push gates passed
• git diff --check origin/main...HEAD: passed

Windows behavior is covered structurally by the existing target detection and .exe naming path; it was not executed on this macOS host.

[themiguelamador]

The new staging step fixes the native stale-stub path, but two correctness issues remain:

• Source validation and destination replacement are interleaved. If a later sidecar is missing or empty, earlier destinations have already been replaced, leaving the mixed fresh/stale set this preflight is meant to prevent. Validate the full SIDECARS array in one loop, then copy in a second loop.
• On Windows, cargo metadata emits a native C:\... target directory. This recipe runs under Git Bash and passes that string to Unix cp, so the .exe handling alone is insufficient. Normalize backslashes to forward slashes before constructing source paths.

I applied both fixes locally in signed commit d5ed45112. Verification passed: all six native sidecars staged byte-for-byte from Cargo's resolved target directory, and a simulated missing final sidecar failed without changing the first destination. The Justfile parses and git diff --check passes. A direct push was attempted because maintainer_can_modify is true, but GitHub returned 403 for the authenticated account.