LLeMbas Desktop: the server in a window, the CLI's agent on this computer

Tauri 2, no Node. A first-run page chooses the server; then the window is
the server's web UI, whose pages get no IPC. The bundled LLeMbas CLI
(fetched and signature-checked by scripts/fetch-cli.sh) links the computer
with 'lembas login --json' and runs as 'lembas service' while the app runs.
A tray menu starts and stops it. Linux packages from GitHub Actions on a tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/fetch-cli.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Put the LLeMbas CLI that LLeMbas Desktop carries where Tauri's bundler wants it:
+#   src-tauri/binaries/lembas-<target triple>
+#
+#   scripts/fetch-cli.sh [target-triple]      (default: this machine's, from rustc)
+#
+# The version is the one in lembas-cli.version. The files are checked exactly as the CLI's own
+# get.sh checks them: SHA256SUMS signed by the release key in the namespace lembas-release, naming
+# this version, and the binary matching it. Nothing unverified is bundled.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+VERSION="$(tr -d '[:space:]' < lembas-cli.version)"
+TRIPLE="${1:-$(rustc -vV | sed -n 's/^host: //p')}"
+BASE="${LEMBAS_CLI_RELEASES:-https://github.com/LLeMbas/LLeMbas-CLI/releases/download}/v${VERSION}"
+PUBKEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDSZO3Byow7R3ZpOH3MCvpPIga2pZBzhfX5wXfNP1cLa"
+
+case "$TRIPLE" in
+  # The baseline build runs on any x86-64 CPU, not only those with AVX2: a desktop app meets
+  # older machines than a server does.
+  x86_64-unknown-linux-gnu) ASSET=lembas-linux-x64-baseline ;;
+  aarch64-unknown-linux-gnu) ASSET=lembas-linux-arm64 ;;
+  *) echo "fetch-cli: no LLeMbas CLI build for $TRIPLE yet" >&2; exit 1 ;;
+esac
+
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+for f in SHA256SUMS SHA256SUMS.sig "$ASSET.gz"; do
+  curl -fsSL --retry 3 -o "$work/$f" "$BASE/$f"
+done
+
+printf 'lembas-release %s\n' "$PUBKEY" > "$work/allowed"
+ssh-keygen -Y verify -f "$work/allowed" -I lembas-release -n lembas-release \
+  -s "$work/SHA256SUMS.sig" < "$work/SHA256SUMS" >/dev/null \
+  || { echo "fetch-cli: SHA256SUMS is not signed by the release key" >&2; exit 1; }
+[ "$(sed -n -E 's/^# lembas //p' "$work/SHA256SUMS" | head -n1)" = "$VERSION" ] \
+  || { echo "fetch-cli: SHA256SUMS is not for $VERSION" >&2; exit 1; }
+(cd "$work" && grep -E "  $ASSET\.gz\$" SHA256SUMS | sha256sum -c --strict --quiet -) \
+  || { echo "fetch-cli: $ASSET.gz does not match SHA256SUMS" >&2; exit 1; }
+
+mkdir -p src-tauri/binaries
+gunzip -c "$work/$ASSET.gz" > "src-tauri/binaries/lembas-$TRIPLE"
+chmod 755 "src-tauri/binaries/lembas-$TRIPLE"
+echo "fetch-cli: LLeMbas CLI $VERSION ($ASSET) -> src-tauri/binaries/lembas-$TRIPLE"