ci(dist): 多平台二进制构建 workflow(macOS arm64/Intel + Linux + Windows*)

.github/workflows/build-binary.yml:
- 触发:打 v* tag 自动构建并附到 GitHub Release;也可 workflow_dispatch 手动
  (不在每次 push 跑——二进制编译慢、耗 runner 分钟)
- 矩阵:macos-14(arm64)/macos-13(Intel)/ubuntu(Linux x86_64) 三个稳定平台
  + windows-latest 实验性(continue-on-error,bash 脚本面向 *nix,Windows 待适配 .exe/MSVC)
- 每平台:checkout → setup-python 3.11 → setup-node 20 → vite build(出 webui-dist)
  → (Linux 装 patchelf) → build_binary.sh(默认含 anthropic/openai,CI 无沙箱回收限制)
  → tar.gz 上传 artifact
- release job:tag 触发时把各平台 tar.gz 附到对应 GitHub Release(softprops/action-gh-release)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/build-binary.yml

@@ -0,0 +1,111 @@
+name: Build Binaries
+
+# 多平台单文件二进制构建（Nuitka）。
+# 触发：打 v* tag 时自动构建并附到 GitHub Release；也可手动 workflow_dispatch。
+# 不在每次 push 跑 —— 二进制编译慢且耗 runner 分钟。
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      onefile:
+        description: "1=单文件(默认) / 0=standalone 目录"
+        required: false
+        default: "1"
+
+permissions:
+  contents: write  # 需要写 Release 附件
+
+jobs:
+  build:
+    name: build (${{ matrix.label }})
+    runs-on: ${{ matrix.os }}
+    continue-on-error: ${{ matrix.experimental }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-14        # Apple Silicon
+            label: macos-arm64
+            experimental: false
+          - os: macos-13        # Intel
+            label: macos-x86_64
+            experimental: false
+          - os: ubuntu-latest    # Linux x86_64
+            label: linux-x86_64
+            experimental: false
+          - os: windows-latest   # Windows x86_64（实验性：脚本面向 *nix，可能需适配）
+            label: windows-x86_64
+            experimental: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Set up Node 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: webui/package-lock.json
+
+      # 前端静态产物（vite build → 仓库根 webui-dist/，供二进制内嵌）
+      - name: Build web UI
+        working-directory: webui
+        run: |
+          npm ci
+          npm run build
+
+      # Linux: Nuitka standalone 需要 patchelf
+      - name: Install patchelf (Linux)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y patchelf
+
+      - name: Build binary
+        shell: bash
+        env:
+          ONEFILE: ${{ github.event.inputs.onefile || '1' }}
+          PROVIDERS: "anthropic openai"
+        run: |
+          chmod +x setup.sh scripts/build_binary.sh
+          bash scripts/build_binary.sh python3
+
+      - name: Package artifact
+        shell: bash
+        run: |
+          mkdir -p out
+          cd dist-binary
+          # 单文件 → 直接打 tar.gz；目录模式 → 整目录打 tar.gz
+          if ls *.app >/dev/null 2>&1; then
+            tar -czf "../out/agentpaas-${{ matrix.label }}.tar.gz" *.app
+          else
+            tar -czf "../out/agentpaas-${{ matrix.label }}.tar.gz" agentpaas* 2>/dev/null || \
+            tar -czf "../out/agentpaas-${{ matrix.label }}.tar.gz" *
+          fi
+          ls -lh ../out
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: agentpaas-${{ matrix.label }}
+          path: out/*.tar.gz
+          if-no-files-found: error
+
+  release:
+    name: Attach to Release
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+      - name: Attach binaries to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: artifacts/**/*.tar.gz
+          fail_on_unmatched_files: false