ci(publish): guard native sidecar platform set

[NathanFlurry]

What changed

• Expands the default secure-exec sidecar publish platform set to Linux x64, Linux arm64, Darwin x64, and Darwin arm64.
• Updates publish tests so package discovery and optional dependency injection cover the full sidecar platform set.
• Updates the sidecar README supported-platform list.

Validation

• pnpm --dir scripts/publish test
• pnpm --dir scripts/publish run check-types
• pnpm --dir packages/sidecar test
• Preview publish: https://github.com/rivet-dev/secure-exec/actions/runs/28068771471

[railway-app]

🚅 Deployed to the secure-exec-pr-120 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
secure-exec	😴 Sleeping (View Logs)		Jun 24, 2026 at 5:13 am

---

🚅 Deployed to the secure-exec-pr-120 environment in secure-exec

Service	Status	Web	Updated (UTC)
secure-exec	😴 Sleeping (View Logs)	Web	Jun 24, 2026 at 5:15 am