ci(release): build and verify the STT sidecar in every packaging pipeline

Packaging silently tolerates a missing resource directory: electron-builder
prints "file source doesn't exist" and continues, which is how installers that
could not transcribe were published.

Every pipeline that packages the desktop app now builds the sidecar and fails
when the engine or its VAD data is absent, so a release cannot ship without
local transcription.

.github/workflows/release.yml

@@ -109,6 +109,15 @@ jobs:
           npm run typecheck
           npm run build --workspace=@d3ro/desktop
 
+      - name: Build STT Sidecar (local transcription engine)
+        run: |
+          # Local transcription depends on the faster-whisper sidecar; a release
+          # that ships without it cannot transcribe at all, so build and verify
+          # the bundle before packaging.
+          npm run sidecar:setup --workspace=@d3ro/desktop
+          npm run sidecar:build --workspace=@d3ro/desktop
+          node scripts/ci/verify-sidecar-bundle.mjs
+
       - name: Package with Electron Builder (NSIS x64)
         shell: pwsh
         run: |
@@ -179,6 +188,15 @@ jobs:
           npm run typecheck
           npm run build --workspace=@d3ro/desktop
 
+      - name: Build STT Sidecar (local transcription engine)
+        run: |
+          # Local transcription depends on the faster-whisper sidecar; a release
+          # that ships without it cannot transcribe at all, so build and verify
+          # the bundle before packaging.
+          npm run sidecar:setup --workspace=@d3ro/desktop
+          npm run sidecar:build --workspace=@d3ro/desktop
+          node scripts/ci/verify-sidecar-bundle.mjs
+
       - name: Package with Electron Builder (DMG & ZIP arm64)
         run: |
           cd apps/desktop