fix(desktop): surface empty-target ACP staging notice in --print-bin-dir runs

ensure-acp-tools.sh printed "No ACP tools locked for target ..." only
in the non---print-bin-dir branch, so the exact invocation path release
builds take (prepare-acp-tools-resource.sh capturing --print-bin-dir
output) suppressed the notice entirely. An empty-target staging — the
failure mode the lock-merge fix guards against — left no trace in build
logs and was only discoverable later via Doctor showing the bridges as
not installed.

Emit the notice to stderr unconditionally before the --print-bin-dir
branch: stderr keeps the --print-bin-dir stdout contract (a single bin
dir path) intact while making the empty staging visible in release
build logs, matching the script's other diagnostics ("Installing ACP
tool ..." already goes to stderr).

Addresses the suppressed-notice finding from the bundling-series code
review (review 2ed3d00d on b52a665a).

Verification:
- --target fake-unknown-target --print-bin-dir: notice on stderr,
  stdout is exactly the bin dir path, exit 0
- --target fake-unknown-target (no flag): notice on stderr, empty
  stdout, exit 0
- real host target --print-bin-dir: no-op stage, prints only the bin
  dir path, exit 0

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>

desktop/scripts/ensure-acp-tools.sh

@@ -132,10 +132,11 @@ entry_count="$(node -e 'process.stdout.write(String(JSON.parse(process.argv[1]).
 mkdir -p "$bin_dir"
 if [[ "$entry_count" == "0" ]]; then
   find "$bin_dir" -type f -delete
+  # stderr so the notice shows up in release build logs even when stdout is
+  # reserved for --print-bin-dir consumers (prepare-acp-tools-resource.sh).
+  echo "No ACP tools locked for target $target." >&2
   if [[ "$print_bin_dir" == "1" ]]; then
     printf '%s\n' "$bin_dir"
-  else
-    echo "No ACP tools locked for target $target."
   fi
   exit 0
 fi