ci: copy the bundler out of the target volume

First dispatch failed at exit 127, "target/release/clawmates-bundler: No such
file or directory". The bundler builds inside a container where /w/target is a
NAMED VOLUME, so the binary was written somewhere no later host step can see —
the workspace's target/ stays empty. Copy it to .tools/ (bind-mounted) and
assert it landed, so the next occurrence fails at the build step with a clear
message instead of two steps later as a missing file.

deploy.yml does not hit this because it copies clawmates-node into
frontend/public/dl/ from inside the same container.

Co-Authored-By: Claude Opus 5 <[email protected]>

.gitea/workflows/release.yml

@@ -88,7 +88,14 @@ jobs:
               apt-get update -qq
               apt-get install -y -qq pkg-config libssl-dev cmake git >/dev/null
               git config --global url."https://oauth2:[email protected]/".insteadOf "https://git.redclaw.dev/"
-              cargo build --release -p clawmates-bundler'
+              cargo build --release -p clawmates-bundler
+              # Copy the binary OUT of the target volume and into the workspace.
+              # /w/target is a named docker volume, so anything left there is
+              # invisible to later steps running on the host — which is exactly
+              # how this failed the first time (exit 127, No such file).
+              mkdir -p /w/.tools
+              cp target/release/clawmates-bundler /w/.tools/clawmates-bundler'
+          test -x .tools/clawmates-bundler || { echo "bundler did not land in the workspace"; exit 1; }
 
       - name: Assemble and sign the bundle
         env:
@@ -98,7 +105,7 @@ jobs:
           test -n "$BUNDLE_SIGNING_KEY" || { echo "BUNDLE_SIGNING_KEY is empty"; exit 1; }
           umask 077
           printf '%s' "$BUNDLE_SIGNING_KEY" > /tmp/release.key
-          BUNDLER=target/release/clawmates-bundler
+          BUNDLER=.tools/clawmates-bundler
           ARTIFACTS=""
           for tar in dist/images/*.tar; do
             ARTIFACTS="$ARTIFACTS $tar=images/$(basename "$tar")"
@@ -130,7 +137,7 @@ jobs:
           set -eu
           umask 077
           printf '%s' "$BUNDLE_SIGNING_KEY" > /tmp/release.key
-          target/release/clawmates-bundler pubkey /tmp/release.key dist/release.pub
+          .tools/clawmates-bundler pubkey /tmp/release.key dist/release.pub
           rm -f /tmp/release.key
           # The customer's exact procedure: the public half only, inside a
           # NETWORK-DISABLED container, proving verification needs no internet.