ci(release): build and verify the STT sidecar in every packaging pipeline

Packaging silently tolerates a missing resource directory: electron-builder
prints "file source doesn't exist" and continues, which is how installers that
could not transcribe were published.

Every pipeline that packages the desktop app now builds the sidecar and fails
when the engine or its VAD data is absent, so a release cannot ship without
local transcription.

.github/workflows/build-mac.yml

@@ -48,15 +48,14 @@ jobs:
         working-directory: apps/desktop
         run: bash scripts/install-sox.sh
 
-      - name: Install Python dependencies
+      - name: Build STT sidecar (PyInstaller)
         working-directory: apps/desktop
         run: |
-          pip install pyinstaller
-          pip install -r sidecar/requirements.txt
-
-      - name: Build sidecar (PyInstaller)
-        working-directory: apps/desktop
-        run: python scripts/build-sidecar.py
+          # 로컬 전사는 사이드카 번들에 의존한다. 누락된 채 패키징하면 설치본에서
+          # 전사가 전혀 동작하지 않으므로 빌드 후 반드시 검증한다.
+          npm run sidecar:setup
+          npm run sidecar:build
+          node ../../scripts/ci/verify-sidecar-bundle.mjs
 
       - name: Rebuild native modules for Electron
         run: npx --yes @electron/rebuild@3 --version=33.4.11