refactor(sidecar): gate JAR embed behind withsidecar build tag

Splits embed.go so the go:embed directive only fires under
-tags withsidecar. Default builds get a stub with a nil JAR
and IsPlaceholder()=true. This removes the landmine where
make uatu overwrote a tracked placeholder file, making any
git add silently stage 130 MB.

internal/sidecar/embed.go

@@ -3,28 +3,12 @@ package sidecar
 import (
 	"crypto/sha256"
 	"encoding/hex"
-	_ "embed"
 	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 )
 
-//go:embed assets/sidecar-all.jar
-var embeddedJAR []byte
-
-// PlaceholderMagic is the byte sequence written to the placeholder JAR that
-// ships in the repository. A binary that still carries the placeholder is
-// not runnable against a real sidecar — `make sidecar && make uatu` must
-// have been invoked to embed the real fat JAR.
-const PlaceholderMagic = "uatu-sidecar-placeholder"
-
-// IsPlaceholder reports whether the embedded JAR is the development
-// placeholder rather than a real sidecar fat JAR.
-func IsPlaceholder() bool {
-	return string(embeddedJAR) == PlaceholderMagic
-}
-
 // EmbeddedSize returns the size in bytes of the embedded JAR.
 func EmbeddedSize() int { return len(embeddedJAR) }
 
@@ -39,7 +23,7 @@ func EmbeddedSHA256() string {
 // matching checksum, no rewrite happens. Returns the JAR path.
 func Extract(dir string) (string, error) {
 	if len(embeddedJAR) == 0 {
-		return "", errors.New("sidecar: embedded JAR is empty")
+		return "", errors.New("sidecar: binary built without -tags withsidecar; rebuild with `make uatu`")
 	}
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		return "", fmt.Errorf("mkdir %s: %w", dir, err)

internal/sidecar/embed_real.go

@@ -0,0 +1,12 @@
+//go:build withsidecar
+
+package sidecar
+
+import _ "embed"
+
+//go:embed assets/sidecar-all.jar
+var embeddedJAR []byte
+
+// IsPlaceholder reports whether the binary was built without the real
+// sidecar JAR embedded. -tags withsidecar builds always return false.
+func IsPlaceholder() bool { return false }

internal/sidecar/embed_stub.go

@@ -0,0 +1,10 @@
+//go:build !withsidecar
+
+package sidecar
+
+var embeddedJAR []byte
+
+// IsPlaceholder reports whether the binary was built without the real
+// sidecar JAR embedded. Build with `make uatu` (which passes
+// -tags withsidecar) to embed the real fat JAR.
+func IsPlaceholder() bool { return true }