Desktop build fails: react-scan script in index.html breaks asset validator

[ball2jh]

Description

The desktop artifact build (dist:desktop:linux) fails because apps/web/index.html includes a dev-only react-scan script via a protocol-relative URL:

<script crossorigin="anonymous" src="//unpkg.com/react-scan/dist/auto.global.js"></script>

The validateBundledClientAssets() function in scripts/build-desktop-artifact.ts (line 403) only skips http:// and https:// URLs. The protocol-relative //unpkg.com/... URL is treated as a local file reference, which doesn't exist on disk, causing the build to fail.

Error

BuildScriptError: Bundled client references missing files in
.../apps/server/dist/client/index.html:
//unpkg.com/react-scan/dist/auto.global.js. Rebuild web/server artifacts.

Suggested Fix

Either (or both):

1. Remove/conditionalize react-scan — it's a dev-only profiling tool and shouldn't be in production builds
2. Fix the validator — add normalizedRef.startsWith("//") to the external URL check in validateBundledClientAssets()

Reproduction

git clone https://github.com/pingdotgg/t3code.git
cd t3code
bun install
bun run dist:desktop:linux

Confirmed broken as of commit b96308f.

[ball2jh]

Closing to re-file with the correct issue template.