ci(release): build and verify the STT sidecar in every packaging pipeline

Packaging silently tolerates a missing resource directory: electron-builder
prints "file source doesn't exist" and continues, which is how installers that
could not transcribe were published.

Every pipeline that packages the desktop app now builds the sidecar and fails
when the engine or its VAD data is absent, so a release cannot ship without
local transcription.

.github/workflows/release-signing-ca.yml

@@ -36,6 +36,13 @@ jobs:
           trusted-signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
           certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE }}
 
+      - name: Build STT Sidecar (local transcription engine)
+        run: |
+          # Without this bundle the packaged app cannot transcribe at all.
+          npm run sidecar:setup --workspace=@d3ro/desktop
+          npm run sidecar:build --workspace=@d3ro/desktop
+          node scripts/ci/verify-sidecar-bundle.mjs
+
       - name: Build and Package Windows (NSIS + RFC 3161 TSA)
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}