ci(release): nightlies system (cron + dispatch, nightly channel) (#592)

[MichaelTaylor3d]

Task

Fan out the VALIDATED nightlies release system (reference: DIG-Network/dig-updater #590/#15) to digstore. Superproject issue DIG-Network/dig_ecosystem#592 (child of epic #590). Release-infra change — do NOT merge; hand to the review gate.

What changed

• Tagger converted changelog-tag.yml → nightly-release.yml: schedule: 0 0 * * * (midnight UTC) + workflow_dispatch (channel, force). Removed push: branches: main. Preserves version-detect ([workspace.package].version), skip-if-tagged idempotency, git-cliff changelog, RELEASE_TOKEN push, loop guard, no-op-if-absent.
• Nightly channel: dated nightly-YYYYMMDD + rolling nightly, prerelease, never latest, keep-14 (anchored filter + --cleanup-tag), delete-then-upload. Nightly does not run the S3 publish (stable-only, so a nightly never moves the latest binary the hub compile-worker reads).
• Reusable build-binaries.yml (workflow_call, version+ref) preserves the guest-wasm prereq (§3.5 / BINDING D6 — built per matrix leg before the CLI), the digs alias, and both asset shapes (bare per-OS binaries + apt .tar.gz) across the 5-target matrix (incl native ubuntu-24.04-arm). release.yml is now tag-only (meta → build → publish + the S3 hub-worker binary upload, both tag-gated).
• R1 force-guard: refuses force-move when a PUBLISHED release exists AND the tag commit differs from HEAD.
• opus note: stable checkout pinned to ref: main.
• A3: un-swallowed gh release list.
• Guard test crates/digstore-cli/tests/nightly_release_workflow_shape.rs (11, incl an assertion that the reusable build ships --bin digstore --bin digs + the digs-* asset). All green locally.
• SPEC §12 + runbooks/release.md document the pipeline + the R2 60-day cron auto-disable recovery.

Version

0.13.1 → 0.13.2 (ci → patch). Cargo.lock synced (cargo update --workspace; 5 workspace crates inherit the version).

Per-repo deviations from the template

• No fmt/clippy check job in the reusable build — digstore's prior release.yml had none (a check would need the guest-wasm for digstore-cli's build.rs, complicating it); ci.yml runs fmt/clippy/test/coverage on every PR, so the release path stays build+publish only. Matches digstore's existing behavior.
• Added workflow_dispatch canary to release.yml (it had none) to match the reference; publish + S3 gated on github.ref_type == 'tag'.
• opus-note-3 (CI build coverage): ci.yml matrix is [ubuntu-latest, windows-latest] — macOS is NOT built on PR, so a midnight stable tag could be cut from a main whose macOS build was never exercised by PR CI. The nightly channel mitigates this (builds all 5 targets from main HEAD nightly, ~24h detection lag). Documented in SPEC §12 + the runbook; adding macОS to ci.yml is a follow-up.
• SPEC release section is §12 (digstore's SPEC ended at §11); no runbooks dir existed, so runbooks/release.md is new.

Verification

• cargo build -p digstore-guest --target wasm32-unknown-unknown --release + cargo test -p digstore-cli --test nightly_release_workflow_shape --locked → 11 passed.
• All three workflow YAMLs parse clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_014CHdgyC9V2Lhhwhuxk3e3r