fix(linux): repair patchelf-corrupted Bun sidecar in AppImage

linuxdeploy injects a RUNPATH ($ORIGIN/../lib) via patchelf into every
usr/bin executable when building the AppDir. The Bun-compiled xpbridge
sidecar (self-contained, JS/assets appended past the ELF) does not
survive ELF rewriting — the patched copy core-dumps on start, so the app
launches but the bridge never listens.

Add scripts/fix-linux-appimage.sh: extract the built AppImage, restore the
pristine repo sidecar, repack with linuxdeploy-plugin-appimage (which does
not patchelf), verify the sidecar is byte-identical, and regenerate the
updater .sig. Wired into scripts/build-linux.sh after `tauri build`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/build-linux.sh

@@ -34,6 +34,12 @@ docker run --rm --platform linux/amd64 \
   "$IMG" \
   bash -c "export PATH=/usr/local/cargo/bin:\$PATH; tauri build --target x86_64-unknown-linux-gnu --bundles $BUNDLES $CFG"
 
+# Repair the Bun sidecar that linuxdeploy's patchelf corrupts inside the AppImage
+# (see scripts/fix-linux-appimage.sh). Runs on the host against the mounted
+# artifacts; regenerates the updater .sig when a signing key is present.
+echo "==> repairing AppImage sidecar"
+bash "$ROOT/scripts/fix-linux-appimage.sh"
+
 echo "==> artifacts:"
 find target-linux/x86_64-unknown-linux-gnu/release/bundle -maxdepth 2 -type f \
   \( -name '*.AppImage' -o -name '*.deb' -o -name '*.AppImage.sig' -o -name '*.tar.gz' -o -name '*.sig' \) 2>/dev/null