fix(cli): make BLE backend opt-in for default builds (#2766)

* fix(cli): make BLE backend opt-in for default builds

* fix(cli): harden BLE dependency guard

docs/BLE-PROBE.md

@@ -12,6 +12,10 @@ Build a live BLE probe for the current machine:
 scripts/build-ble-probe.sh live
 ```
 
+Live builds use the `ble_live` build tag and link the host BLE stack. The
+default `cli-printing-press` and `ble-probe` builds are replay-only so ordinary
+generation and verification paths do not load Bluetooth frameworks.
+
 Build a copyable Windows artifact from macOS:
 
 ```bash

internal/cli/device_sniff_test.go

@@ -4,7 +4,9 @@ import (
 	"bytes"
 	"encoding/json"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/mvanhorn/cli-printing-press/v4/internal/devicesniff/ble"
@@ -251,3 +253,16 @@ func TestDeviceSniffBLECmdRequiresCapturedEvidenceInput(t *testing.T) {
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "required flag(s) \"input\" not set")
 }
+
+func TestDefaultCLIBuildDoesNotLinkTinyGoBluetooth(t *testing.T) {
+	t.Parallel()
+
+	cmd := exec.Command("go", "list", "-deps", "-f", "{{.ImportPath}}", "./cmd/cli-printing-press")
+	cmd.Dir = filepath.Join("..", "..")
+	output, err := cmd.CombinedOutput()
+	require.NoError(t, err, string(output))
+
+	for dep := range strings.FieldsSeq(string(output)) {
+		assert.False(t, strings.HasPrefix(dep, "tinygo.org/x/bluetooth"), "default cli-printing-press builds must not link the live BLE backend (got %s)", dep)
+	}
+}

internal/devicesniff/ble/adapter_live_unavailable.go

@@ -1,4 +1,4 @@
-//go:build ble_replay_only || !(darwin || linux || windows)
+//go:build !ble_live || ble_replay_only || !(darwin || linux || windows)
 
 package ble
 

internal/devicesniff/ble/driver_tinygo.go

@@ -1,4 +1,4 @@
-//go:build !ble_replay_only && (darwin || linux || windows)
+//go:build ble_live && !ble_replay_only && (darwin || linux || windows)
 
 package ble
 

scripts/build-ble-probe.sh

@@ -90,11 +90,11 @@ build_one() {
 }
 
 build_replay_target() {
-  build_one replay "$1" "$2" ble_replay_only
+  build_one replay "$1" "$2" ""
 }
 
 build_live_target() {
-  build_one live "$1" "$2" ""
+  build_one live "$1" "$2" ble_live
 }
 
 if [[ -n "$target" ]]; then