refactor(sidecar): gate JAR embed behind withsidecar build tag

Splits embed.go so the go:embed directive only fires under
-tags withsidecar. Default builds get a stub with a nil JAR
and IsPlaceholder()=true. This removes the landmine where
make uatu overwrote a tracked placeholder file, making any
git add silently stage 130 MB.

internal/sidecar/embed_real.go

@@ -0,0 +1,12 @@
+//go:build withsidecar
+
+package sidecar
+
+import _ "embed"
+
+//go:embed assets/sidecar-all.jar
+var embeddedJAR []byte
+
+// IsPlaceholder reports whether the binary was built without the real
+// sidecar JAR embedded. -tags withsidecar builds always return false.
+func IsPlaceholder() bool { return false }