fix(ci): fetch llama-server sidecar before lint in release publish job

.github/workflows/release-please.yml

@@ -4,6 +4,16 @@ on:
   push:
     branches:
       - main
+  # Manually (re)build and upload assets for an existing release tag, e.g. when
+  # a prior run failed after release-please had already created the release. The
+  # release-please job is a no-op on dispatch (the release already exists), and
+  # the build job is gated to run on dispatch via github.event_name below.
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing release tag to build and upload assets for (e.g. v0.15.0)'
+        required: true
+        type: string
 
 permissions:
   contents: write
@@ -58,11 +68,15 @@ jobs:
   build-and-release:
     name: Build and publish macOS app
     needs: release-please
-    if: ${{ needs.release-please.outputs.release_created }}
+    if: ${{ needs.release-please.outputs.release_created || github.event_name == 'workflow_dispatch' }}
     runs-on: macos-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          # On manual dispatch, build the exact released source for the requested
+          # tag. On push, this is empty and checkout uses the triggering commit.
+          ref: ${{ inputs.tag }}
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
@@ -83,6 +97,19 @@ jobs:
       - name: Install frontend dependencies
         run: bun install --frozen-lockfile
 
+      # The sidecar must be present before any cargo invocation. lint:backend
+      # (cargo clippy) and test:all:coverage (cargo llvm-cov) both run build.rs,
+      # which fails if binaries/llama-server-<triple> is missing. Restore the
+      # cache and fetch on miss before the first lint step, not after.
+      - name: Cache llama.cpp sidecar
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        with:
+          path: src-tauri/binaries
+          key: llama-cpp-${{ runner.os }}-b9781-50e822733750dbc3
+
+      - name: Fetch llama-server sidecar
+        run: bun run engine:ensure
+
       - name: Lint and format check
         run: bun run lint && bun run format:check
 
@@ -95,12 +122,6 @@ jobs:
       - name: Build frontend
         run: bun run build:frontend
 
-      - name: Cache llama.cpp sidecar
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
-        with:
-          path: src-tauri/binaries
-          key: llama-cpp-${{ runner.os }}-b9781-50e822733750dbc3
-
       - name: Build Tauri app
         run: bun run build:backend
 
@@ -113,7 +134,7 @@ jobs:
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          TAG: ${{ needs.release-please.outputs.tag_name }}
+          TAG: ${{ needs.release-please.outputs.tag_name || inputs.tag }}
         working-directory: src-tauri/target/release/bundle/macos
         run: |
           VERSION="${TAG#v}"
@@ -125,7 +146,7 @@ jobs:
 
       - name: Generate updater manifest
         env:
-          TAG: ${{ needs.release-please.outputs.tag_name }}
+          TAG: ${{ needs.release-please.outputs.tag_name || inputs.tag }}
         working-directory: src-tauri/target/release/bundle/macos
         run: |
           VERSION="${TAG#v}"
@@ -206,7 +227,7 @@ jobs:
       - name: Upload release assets
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ needs.release-please.outputs.tag_name }}
+          TAG: ${{ needs.release-please.outputs.tag_name || inputs.tag }}
         working-directory: src-tauri/target/release/bundle
         run: |
           VERSION="${TAG#v}"