feat: add Desktop Nightly update channel

[Astro-Han]

Summary

Add a developer-only Desktop Nightly channel that builds the exact scheduled main commit for macOS arm64 and Windows x64 without participating in the ASF source-release vote.

Each fresh workflow run owns one immutable 0.2.0-dev.YYYYMMDD.run version. Publication is append-only: verified versioned payloads are uploaded first, then the independent macOS and Windows feeds advance. In-place workflow reruns are rejected; a failed Nightly is retried with a fresh dispatch and therefore a fresh version.

Nightly packages embed an isolated Apache Nightlies feed, accept only newer dev versions, and verify downloaded bytes against Sigstore provenance issued by the Nightly workflow on main. Publishing uses the protected nightly Environment and the hosted runner's rsync with an Infra-verified known_hosts entry; no third-party deployment action receives the SSH key.

The workflow remains disabled until Apache Infra publishing, retention ownership, and the protected nightly Environment are configured.

Verification

• node --test --test-concurrency=1 scripts/desktop-nightly.test.mjs scripts/desktop-nightly-stage.test.mjs scripts/desktop-nightly-workflow-policy.test.mjs scripts/ci-test-plan.test.mjs scripts/verify-windows-harness.test.mjs (98 passed)
• Focused bundled tests for app-update-service.test.ts and app-update-attestation.test.ts (18 passed)
• node --test --test-name-pattern='Desktop packaging derives|platform package verifiers' scripts/product-release.test.mjs (2 passed)
• actionlint .github/workflows/desktop-nightly.yml
• Biome checks and git diff --check
• tsc -p apps/desktop/tsconfig.main.json --noEmit remains blocked by existing stale workspace/test types unrelated to this diff (llmConnectionId, SessionConfigurationPatch, and MCP store exports).

Rollout

• Apache Infra whitelists apache/maka for Nightlies publishing, supplies an authenticated SSH known_hosts entry, and confirms whether retention is service-managed or project-managed.
• Create the nightly Environment restricted to main; store all Nightlies rsync and Apple signing/notarization secrets there.
• After merge and external setup, set DESKTOP_NIGHTLY_ENABLED=true.
• Run two fresh manual builds and verify a real automatic update on clean macOS and Windows machines before sharing the channel.

Nightly currently uses the same application identity and user-data location as the formal Desktop, so installing it replaces the existing Maka installation rather than adding a side-by-side app. Clean remote Runtime Host setup remains outside this channel because Nightly does not publish a matching npm package.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented the workflow, channel authority, staging/verification scripts, tests, operations documentation, and adversarial review fixes. The human contributor must review the final diff, provenance, licensing, and rollout configuration before merge.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No