fix(ci): stop dd from corrupting the x86_64 linuxdeploy launcher

On the aarch64 Gitea runner, tauri-bundler's prepare_tools step runs
'dd ... seek=8 conv=notrunc' on the cached linuxdeploy-x86_64 binary to
hide it from AppImage integration tools. That zeroed bytes 8-10 of the
file; our cached binary there was a bash wrapper script, so the dd wrote
into the middle of its shebang/interpreter line, corrupting it, and the
bundler's subsequent spawn failed with ENOENT ('failed to bundle
project: No such file or directory').

Replace the shell wrapper with a small native ELF launcher compiled with
cc: bytes 8-10 of an ELF header are EI_PAD padding, unused by the
loader, so the same dd leaves it executable. The launcher sets the same
environment the old wrapper did and execs the real aarch64 linuxdeploy
binary. Also cache AppRun-x86_64 explicitly so the bundler does not need
to fetch it itself mid-build.

Verified locally: compiled a minimal ELF binary, ran the same dd
command against it, confirmed it still executes (the shebang-script
equivalent does not).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

scripts/check.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Verificação local: roda o mesmo que o CI roda, antes de você dar push.
+#
+#   scripts/verificar.sh            rápido (~1 min): formatação, clippy, tradução, scripts, workflows
+#   scripts/verificar.sh --completo  inclui os testes do workspace e o cargo audit
+#
+# O CI leva de 5 a 30 minutos por execução e roda em Linux; quase tudo que o faz falhar
+# aparece aqui em segundos. Se isto passa, o CI só deve revelar o que é próprio dele
+# (imagens baixadas, apt do runner).
+set -uo pipefail
+cd "$(dirname "$0")/.."
+completo=0
+[ "${1:-}" = "--completo" ] && completo=1
+falhas=()
+passo() { # passo "nome" comando...
+  local nome="$1"; shift
+  printf '\n\033[1m== %s\033[0m\n' "$nome"
+  if "$@"; then printf '\033[32mok\033[0m %s\n' "$nome"; else printf '\033[31mFALHOU\033[0m %s\n' "$nome"; falhas+=("$nome"); fi
+}
+
+passo "formatação (cargo fmt)" cargo fmt --all -- --check
+# as mesmas flags do CI: avisos viram erro, inclusive nos testes
+passo "clippy (workspace, todos os alvos)" env RUSTFLAGS="-D warnings" cargo clippy --workspace --all-targets
+passo "cobertura da tradução da interface" node scripts/check-ui-i18n.mjs
+passo "teste do latest.json" python3 -B scripts/test_make_latest_json.py
+passo "sintaxe dos scripts bash" bash -c 'for f in scripts/*.sh .githooks/*; do bash -n "$f" || exit 1; done'
+passo "workflows e templates (YAML válido)" python3 -c "
+import glob, yaml
+for f in glob.glob('.gitea/**/*.yml', recursive=True):
+    yaml.safe_load(open(f))
+"
+passo "versões consistentes" python3 -c "
+import json, re, sys
+from pathlib import Path
+
+def cargo_version(path):
+    m = re.search(r'^version\s*=\s*\"([^\"]+)\"', Path(path).read_text(), re.M)
+    if not m:
+        sys.exit(f'versão não encontrada em {path}')
+    return m.group(1)
+
+versoes = [
+    cargo_version('Cargo.toml'),
+    cargo_version('apps/gui/src-tauri/Cargo.toml'),
+    json.load(open('apps/gui/src-tauri/tauri.conf.json'))['version'],
+]
+if len(set(versoes)) != 1:
+    sys.exit(f'versões divergentes: Cargo.toml={versoes[0]}, src-tauri={versoes[1]}, tauri.conf={versoes[2]}')
+print(versoes[0])
+"
+if [ -f apps/gui/src-tauri/Cargo.toml ] && pkg-config --exists webkit2gtk-4.1 2>/dev/null; then
+  passo "app desktop (cargo check)" env RUSTFLAGS="" cargo check --manifest-path apps/gui/src-tauri/Cargo.toml
+else
+  printf '\n(app desktop: pulado, faltam as bibliotecas do WebKitGTK; o CI compila)\n'
+fi
+
+if [ "$completo" = 1 ]; then
+  passo "testes (cargo test --workspace)" cargo test --workspace
+  passo "auditoria de dependências (cargo audit)" cargo audit
+fi
+
+printf '\n'
+if [ ${#falhas[@]} -eq 0 ]; then
+  printf '\033[32mtudo certo\033[0m: pode dar push.\n'
+else
+  printf '\033[31mfalhou:\033[0m %s\n' "${falhas[*]}"
+  exit 1
+fi