A binary embeds the absolute paths of its sources: Rust panic locations in
textream.exe, and __FILE__ in the sherpa-onnx library, which this build
compiles locally with MSVC. `bun run release` now builds through wayBetter's
build-env (paths remapped for Rust, trimmed for MSVC C++) and then runs its
privacy-scan over the finished installer; a hit fails the release. The
reviewed false positives (an ONNX operator name, an HTTP header name) are in
privacy-allowlist.txt.
