Restore Linux AppImage by moving Pi sidecar out of bundle.externalBin

[jamesbrink]

Context

#824 dropped appimage from the Linux nightly + release build matrix because linuxdeploy's gtk plugin segfaults (SIGABRT, exit 134) when it tries to extract DT_NEEDED entries from the Pi harness sidecar — a ~93 MB ELF that bun build --compile produces with the JS bytecode appended in a section linuxdeploy can't parse.

The error (only visible after --verbose surfaced linuxdeploy's swallowed stderr):

Deploying dependencies for ELF file .../usr/bin/claudette-pi-harness
linuxdeploy-plugin-gtk.sh: line 296: 33188 Aborted (core dumped) ...
ERROR: Failed to run plugin: gtk (exit code: 134)

linuxdeploy has no per-binary skip knob — it scans every executable in usr/bin/. So as long as the Pi sidecar is in bundle.externalBin (which tauri-bundler copies to usr/bin/), the AppImage path is broken.

Goal

Restore appimage to the Linux build matrix in .github/workflows/nightly.yml and .github/workflows/release-please.yml without re-breaking the bundle.

Approach

Move claudette-pi-harness out of bundle.externalBin to a path linuxdeploy doesn't scan:

• src-tauri/tauri.conf.json: remove binaries/claudette-pi-harness from bundle.externalBin. Keep binaries/pi/package.json as a resource. Add the harness binary as a resource too, at a path that lands under Resources//usr/share/<bundle>/ (not usr/bin/).
• scripts/stage-pi-harness-sidecar.sh: stage the harness at the new path instead of src-tauri/binaries/claudette-pi-harness-<triple>.
• src/agent/pi_sdk.rs (resolve_pi_harness_path): teach the resolver about the new resource-dir layout for every platform shape (Contents/Resources/ on macOS, usr/share/claudette/ on Linux .deb, resources/ on Windows zip).
• src-tauri/tauri.no-pi.conf.json: drop the harness from the no-pi overlay too.
• Tests: extend the pi_sdk resolver tests to assert the new layout. Smoke-check on macOS, .deb, AppImage, and Windows zip after the change.

Acceptance criteria

• Revert the bundles: deb change from ci(linux): drop appimage from nightly/release matrix + pass --verbose to tauri build #824 — Linux nightly + release produce both .deb and .AppImage again.
• linuxdeploy no longer scans the Pi binary (it lives outside usr/bin/).
• Pi continues to launch from the .app, .deb, .AppImage, and Windows zip on first run with no env overrides.
• installation.mdx's temporary callout about missing AppImage is removed.

Why not in #824

It's a multi-file refactor that touches Rust, staging, and bundling. #824 is a hotfix to unbreak nightly today; this is the durable fix.