refactor(sidecar): gate JAR embed behind withsidecar build tag

Splits embed.go so the go:embed directive only fires under
-tags withsidecar. Default builds get a stub with a nil JAR
and IsPlaceholder()=true. This removes the landmine where
make uatu overwrote a tracked placeholder file, making any
git add silently stage 130 MB.

internal/sidecar/embed_stub.go

@@ -0,0 +1,10 @@
+//go:build !withsidecar
+
+package sidecar
+
+var embeddedJAR []byte
+
+// IsPlaceholder reports whether the binary was built without the real
+// sidecar JAR embedded. Build with `make uatu` (which passes
+// -tags withsidecar) to embed the real fat JAR.
+func IsPlaceholder() bool { return true }