Refresh the workshop gateway sidecar from the built gateway

The workshop declares the gateway as a Tauri external binary, so every workshop build copied the hand-placed sidecar under binaries over the gateway binary cargo had just built into the same target path. Building the gateway and then the workshop therefore reverted the gateway to whatever snapshot last landed in binaries. The build script now copies the freshly built gateway forward into the sidecar slot before tauri-build runs, so that build order ships the gateway just built.

- `refresh_gateway_sidecar` resolves the profile directory from `OUT_DIR`, copies `promptforge-gateway` into `binaries/promptforge-gateway-<target>` when the built file is newer or differs in length, and emits `cargo:rerun-if-changed` on the built path so a gateway rebuild re-runs the script.
- `sidecar_is_current` compares length and modification time, so an unchanged gateway costs no copy.
- A missing built gateway is left to tauri-build to report; the script does not fail the workshop build on its own.

Design: new hidden-dependency @ crates/workshop/build.rs::refresh_gateway_sidecar deps: none boundary: pub instead-of: temporal-coupling: the sidecar copy no longer depends on a manual step between the two builds
Repairs: sidecar freshness @ crates/workshop/build.rs - a gateway rebuild followed by a workshop rebuild left the September 10 sidecar in target/release in place of the gateway just built
Plan: none

Close plan: remove unsupported ratchets

Plan: vibe/2026-09-08-1-remove-unsupported-ratchets.md

Add evergreen release links and baked version display

Workshop releases need stable download URLs, and both UIs must show the real crate version instead of a hardcoded string. The release workflow now sets `make_latest: true` and uploads version-free installer copies to the rolling `promptforge-workshop-latest` release. The Workshop About dialog and the Gateway config UI tab bar read the version from the build-time `__APP_VERSION__` define.

- `build.mjs` reads the version from the workspace `Cargo.toml` and `build.rs` sets `define_app_version: true`, so both the watch workflow and `cargo build` bake `__APP_VERSION__` into the bundle.
- The evergreen names are copies staged in `dist/evergreen`, so the versioned release keeps its versioned asset names; `gh release upload` and `gh release create` now carry `dist/latest.json dist/evergreen/*`.
- Bundles built without the define fall back to `"dev"` in `about-dialog.ts` and `tab-bar.ts` instead of breaking on a free identifier.
- `tab-bar.test.mjs` pins the `.tab-version` label in the actions cluster; `window-menu.mjs` defines `__APP_VERSION__` as `"0.0.0-test"` and asserts the About dialog renders it.
- The workflow's rename-and-upload step has no test; it runs only in CI.

Pin the Blackwell CUDA release checksum

Document WebView2 unsafe call invariants

Build and select each platform updater artifact

Find the NSIS app in its actual install root

Keep installer smoke tests offline

Preseed a model-free profile so release validation measures package startup instead of first-run model download speed.

Document WebView2 unsafe call invariants

Fix rustdoc CI: replace private-item doc link with plain backticks