ci(desktop): build x64 macOS sidecar on Intel runner; pass RUSTFAVA_VERSION

Folds #197 into this branch (both edit desktop-release.yml):

- Build the x86_64-apple-darwin sidecar and Tauri bundle on macos-13 (Intel):
  PyInstaller can't cross-compile and macos-latest is now Apple Silicon (#193).
- Verify sidecar/bundled-sidecar architecture with `file -b | grep -qw` so the
  arch-bearing filename can't false-match (#193).
- Set RUSTFAVA_VERSION from the release tag before the PyInstaller build, so the
  spec bakes the real version into rustfava/_version.py (#191).

Reconciles cleanly with this branch's switch of the engine wasm download from
the removed ffi-wasi artifact to ffi-component.

Co-Authored-By: Rob Cohen <rob@robcohen.dev>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: robcohen

.github/workflows/desktop-release.yml

@@ -40,7 +40,10 @@ jobs:
           - os: ubuntu-22.04
             target: x86_64-unknown-linux-gnu
             sidecar_name: rustfava-server-x86_64-unknown-linux-gnu
-          - os: macos-latest
+          # PyInstaller cannot cross-compile: it emits a binary for the
+          # runner's own arch. macos-latest is now Apple Silicon, so the x64
+          # sidecar must build on a real Intel runner (issue #193).
+          - os: macos-13
             target: x86_64-apple-darwin
             sidecar_name: rustfava-server-x86_64-apple-darwin
           - os: macos-14
@@ -119,6 +122,13 @@ jobs:
               print(f'Compiled {po} -> {mo}')
           "
 
+      - name: Set RUSTFAVA_VERSION from tag
+        # The spec bakes this into rustfava/_version.py so the frozen binary
+        # reports the real version without dist-info metadata (issue #191).
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        run: echo "RUSTFAVA_VERSION=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_ENV"
+
       - name: Build sidecar with PyInstaller
         shell: bash
         run: |
@@ -134,6 +144,24 @@ jobs:
         run: |
           move dist\rustfava.exe dist\${{ matrix.sidecar_name }}
 
+      - name: Verify sidecar architecture (macOS)
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          BIN="dist/${{ matrix.sidecar_name }}"
+          file "$BIN"
+          case "${{ matrix.target }}" in
+            x86_64-*) EXPECT="x86_64" ;;
+            aarch64-*) EXPECT="arm64" ;;
+            *) echo "::error::Unknown macOS target ${{ matrix.target }}"; exit 1 ;;
+          esac
+          # Use `file -b` (no filename) so the sidecar_name — which itself
+          # contains "x86_64"/"aarch64" — can't false-match the grep.
+          if ! file -b "$BIN" | grep -qw "$EXPECT"; then
+            echo "::error::Sidecar arch mismatch: expected $EXPECT for ${{ matrix.target }}, got: $(file -b "$BIN")"
+            exit 1
+          fi
+
       - name: Upload sidecar artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -218,7 +246,9 @@ jobs:
           - os: ubuntu-22.04
             target: x86_64-unknown-linux-gnu
             sidecar_name: rustfava-server-x86_64-unknown-linux-gnu
-          - os: macos-latest
+          # Intel runner: builds x86_64 natively so the smoke test can launch
+          # the binary (an arm64 runner has no Rosetta by default), issue #193.
+          - os: macos-13
             target: x86_64-apple-darwin
             sidecar_name: rustfava-server-x86_64-apple-darwin
           - os: macos-14
@@ -317,6 +347,26 @@ jobs:
           ls -la "$APP_PATH" || { echo "App bundle not found!"; exit 1; }
           file "$BINARY"
 
+          # Verify the bundled sidecar matches the target arch (issue #193).
+          # Tauri strips the target triple, so the bundled name is plain
+          # `rustfava-server` (no arch substring to confuse the grep).
+          SIDECAR="$APP_PATH/Contents/MacOS/rustfava-server"
+          if [ -f "$SIDECAR" ]; then
+            file "$SIDECAR"
+            case "${{ matrix.target }}" in
+              x86_64-*) EXPECT="x86_64" ;;
+              aarch64-*) EXPECT="arm64" ;;
+              *) echo "::error::Unknown macOS target ${{ matrix.target }}"; exit 1 ;;
+            esac
+            if ! file -b "$SIDECAR" | grep -qw "$EXPECT"; then
+              echo "::error::Bundled sidecar arch mismatch: expected $EXPECT for ${{ matrix.target }}, got: $(file -b "$SIDECAR")"
+              exit 1
+            fi
+          else
+            echo "::error::Bundled sidecar not found at $SIDECAR"
+            exit 1
+          fi
+
           # Run binary directly to capture stdout/stderr and panic backtrace
           echo "=== Launching with RUST_BACKTRACE=full ==="
           RUST_BACKTRACE=full RUST_LOG=debug "$BINARY" > /tmp/app.log 2>&1 &