feat: bundle a slim goose agent (goose-acp) as a desktop sidecar

Adds goose-acp/, a workspace-excluded crate that builds goose's ACP
stdio server from the goose library crate with default-features off
(rustls-tls only): no code-mode/V8, no local-inference/llama.cpp, no
keyring/AWS/telemetry, no goose CLI. Full agent loop, providers,
sessions, and MCP extensions intact. ~32 MB on macOS arm64 (~9 MB
added to the compressed download) vs ~240 MB for a stock goose
install; drops to ~14 MB once goose's analyze/tiktoken feature gates
land upstream and the rev pin is bumped.

Workspace exclusion is deliberate: goose's ~700-crate graph stays out
of the workspace lockfile, and rmcp stays pinned at 1.7.0 (goose does
not compile against 1.8) in goose-acp's own Cargo.lock.

Wiring:
- buzz-acp: goose-acp identity takes no 'acp' subcommand (it is
  already the ACP server), with tests
- desktop: goose runtime discovery also accepts goose-acp, so the
  bundled sidecar is found when no user-installed goose exists;
  orphan sweep already matches it via the goose- prefix rule
- packaging: tauri externalBin entry, sidecar stubs (justfile + CI),
  bundle-sidecars.sh stages it when built, release workflow builds it
  for all targets

.github/workflows/ci.yml

@@ -827,7 +827,7 @@ jobs:
         shell: bash
         run: |
           mkdir -p desktop/src-tauri/binaries
-          for bin in buzz-acp buzz-agent buzz-dev-mcp git-credential-nostr buzz; do
+          for bin in buzz-acp buzz-agent buzz-dev-mcp git-credential-nostr buzz goose-acp; do
             touch "desktop/src-tauri/binaries/${bin}-${TARGET}.exe"
           done
       - name: Clippy (workspace)
@@ -904,6 +904,7 @@ jobs:
           touch "desktop/src-tauri/binaries/buzz-dev-mcp-$TARGET"
           touch "desktop/src-tauri/binaries/git-credential-nostr-$TARGET"
           touch "desktop/src-tauri/binaries/buzz-$TARGET"
+          touch "desktop/src-tauri/binaries/goose-acp-$TARGET"
       # Mesh rev is derived from Cargo.lock so a dependency bump needs no
       # lockstep edit here; the cache key tracks it automatically.
       - name: Resolve mesh-llm rev

.github/workflows/release.yml

@@ -130,6 +130,7 @@ jobs:
       - name: Build sidecars
         run: |
           cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
+          cargo build --release --manifest-path goose-acp/Cargo.toml
           ./scripts/bundle-sidecars.sh
 
       # Mesh rev derived from Cargo.lock (no lockstep edit on dep bump); cache key tracks it.
@@ -334,6 +335,7 @@ jobs:
       - name: Build sidecars
         run: |
           cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
+          cargo build --release --target "$TARGET" --manifest-path goose-acp/Cargo.toml
           ./scripts/bundle-sidecars.sh "$TARGET"
 
       - name: Build unsigned Tauri app
@@ -504,6 +506,7 @@ jobs:
       - name: Build sidecars
         run: |
           cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
+          cargo build --release --manifest-path goose-acp/Cargo.toml
           ./scripts/bundle-sidecars.sh
 
       - name: Generate release config
@@ -645,6 +648,7 @@ jobs:
         shell: bash
         run: |
           cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
+          cargo build --release --target "$TARGET" --manifest-path goose-acp/Cargo.toml
           ./scripts/bundle-sidecars.sh "$TARGET"
 
       - name: Build Windows NSIS installer (unsigned)