fix(server): verify built binary embeds compiled openwork-server

[yashranaway]

Closes #1229

Summary

• Run the produced openwork-server binary with --version immediately after bun build --compile and confirm the output matches the package version.
• Fail the build loudly when the produced binary is a bare Bun runtime (or anything else that does not respond with the expected version), so a stub binary cannot ship in a desktop .deb and propagate to AUR.
• Skip the verification step for cross-target builds where the host cannot execute the produced binary.

Verification

• pnpm --filter openwork-server typecheck clean.
• bun ./script/build.ts --outdir /tmp/owork-server-test --filename openwork-server produces a working binary; /tmp/owork-server-test/openwork-server --version prints the package version.
• Replacing the produced binary with a copy of the host bun and re-running the verification logic exits non-zero with expected --version: 0.13.3 / actual stdout: 1.3.6, matching the symptom in the issue.

Notes

• Out of scope: changing the build:bin shorthand in apps/server/package.json (developer convenience path) and the equivalent server-v2 build script. The release path that feeds Tauri externalBin and the .deb asset goes through apps/desktop/scripts/prepare-sidecar.mjs -> apps/server/script/build.ts, which is what this PR hardens.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	May 5, 2026 6:50pm

[vercel]

@yashranaway is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.

[yashranaway]

@src-opn Can you please take a look?

[src-opn]

@yashranaway plz dont tag, we review things regularly. tagging should only be used for crucial important stuff

[yashranaway]

my bad, thanks