ci: run the 541 lines of tag-gated tests

The withsidecar tag appeared only under go build, go install and go run, so
internal/sidecarassets' 167 lines, including a four-goroutine torn-write race
test, had never been compiled into a test binary. The three withcompanion files
were reachable only through make test-companion, which no job invoked. Both now
run: the sidecar tests in check-tests while JDK 17 is still active, the
companion tests in folio-ios where the bundles are already staged.

.github/workflows/ci.yml

@@ -118,6 +118,13 @@ jobs:
       - name: Run tests
         run: make test
 
+      # The withsidecar-tagged tests had never been compiled into a test
+      # binary: the tag appears only under go build, go install and go run.
+      # They cover the embedded JAR's extraction, checksum reuse and the
+      # concurrent-extraction race, so they need the staged JAR to be real.
+      - name: Run the sidecar-tagged tests
+        run: make test-sidecar
+
       # folio is its own gradle build, and the metro plugin it compiles with
       # needs a 21 runtime where the sidecar toolchain pins 17. Switching
       # JAVA_HOME after `make test` rather than installing both up front
@@ -266,6 +273,13 @@ jobs:
       - name: Build sanderling
         run: make sanderling-ios
 
+      # The withcompanion-tagged tests are reachable only through this target
+      # and no other job invokes it. It runs here because staging the companion
+      # and runner bundles needs the darwin toolchain, and make sanderling-ios
+      # has already built both.
+      - name: Run the companion-tagged tests
+        run: make test-companion
+
       # simctl resolves a device by name alone, and one image carries the same
       # phone under several runtimes: iPhone 17 Pro exists here on iOS 26.2,
       # 26.4 and 26.5. Booting by name is therefore booting on whichever one