fix(gui): confine the installer's sidecar to the installer build

Naming the file tauri.windows.conf.json made Tauri merge it into every Windows
build automatically, and externalBin is resolved by the build script — so a
bare `cargo check` in src-tauri started failing with "resource path
binaries\ostp-tun-helper-x86_64-pc-windows-msvc.exe doesn't exist" unless the
sidecar had been staged first. That broke the release script's own cargo check
and would have broken the portable zip build too.

Renamed to tauri.installer.conf.json, which Tauri does not pick up on its own,
and passed explicitly with --config from the one step that wants it. Plain
builds are back to exactly what they were; only the installer needs staging.

.github/workflows/release.yml

@@ -404,7 +404,6 @@ jobs:
         run: |
           npm install
           cargo build -p ostp-tun-helper --release --target ${{ matrix.target }}
-          node stage-sidecar.js --release --target ${{ matrix.target }}
           npx tauri build --no-bundle --target ${{ matrix.target }}
 
       - name: Package Portable ZIP
@@ -421,9 +420,15 @@ jobs:
       # The installer is what removes the per-connect consent prompt: it runs
       # elevated, so its hook can register the helper's Scheduled Task once.
       # The portable zip above cannot, and falls back to asking on first connect.
+      # The sidecar and its config are confined to this step: declaring
+      # externalBin in an auto-merged tauri.windows.conf.json would force every
+      # Windows build, down to a bare `cargo check`, to have the helper staged
+      # first, and fail the build script when it is not.
       - name: Build NSIS Installer
         working-directory: ostp-gui
-        run: npx tauri build --bundles nsis --target ${{ matrix.target }}
+        run: |
+          node stage-sidecar.js --release --target ${{ matrix.target }}
+          npx tauri build --bundles nsis --target ${{ matrix.target }} --config src-tauri/tauri.installer.conf.json
 
       - name: Collect installer
         shell: pwsh

ostp-gui/package.json

@@ -5,9 +5,9 @@
   "type": "module",
   "scripts": {
     "tauri": "tauri",
-    "dev": "cargo build -p ostp-tun-helper && node stage-sidecar.js && npx tauri dev",
-    "build": "cargo build -p ostp-tun-helper --release && node stage-sidecar.js --release && npx tauri build --no-bundle",
-    "build:installer": "cargo build -p ostp-tun-helper --release && node stage-sidecar.js --release && npx tauri build --bundles nsis",
+    "dev": "cargo build -p ostp-tun-helper && npx tauri dev",
+    "build": "cargo build -p ostp-tun-helper --release && npx tauri build --no-bundle",
+    "build:installer": "cargo build -p ostp-tun-helper --release && node stage-sidecar.js --release && npx tauri build --bundles nsis --config src-tauri/tauri.installer.conf.json",
     "build:dist": "npm run build && node build_dist.js",
     "sidecar": "node stage-sidecar.js"
   },

ostp-gui/stage-sidecar.js

@@ -1,13 +1,16 @@
 // Stages ostp-tun-helper where Tauri expects a sidecar.
 //
-// tauri.windows.conf.json declares `externalBin: ["binaries/ostp-tun-helper"]`,
+// tauri.installer.conf.json declares `externalBin: ["binaries/ostp-tun-helper"]`,
 // and Tauri resolves that to `binaries/ostp-tun-helper-<target-triple>.exe` at
 // build time, failing the build outright when the file is absent. Cargo writes
-// the plain name instead, so every Windows build — dev, portable zip and
-// installer alike — has to copy it across first.
+// the plain name instead, so it has to be copied across first.
 //
-// A no-op off Windows: externalBin lives in the Windows-only config, so the
-// Linux and macOS GUI builds neither need nor have a helper sidecar.
+// Only the installer build needs this. That config is passed explicitly with
+// --config rather than being named tauri.windows.conf.json, which Tauri would
+// merge into every Windows build automatically — and then even a bare
+// `cargo check` would fail on the missing sidecar.
+//
+// A no-op off Windows: the Linux and macOS GUI builds have no helper sidecar.
 
 const fs = require('fs');
 const path = require('path');