ci/nightly: SHA-gate cron, publish dated nightly-* releases, BUILD_ID in os-release

[widgetii]

Summary

PR-A of six in the nightly-build redesign. Touches only CI and one rootfs script; no on-device flag day.

• Preflight gate — new preflight job in build.yml reads the sha= line from the rolling nightly release body and skips the matrix on schedule events when HEAD matches. PRs and workflow_dispatch always build (this PR will itself trigger a full matrix as proof).
• Three release tags per build —
  • nightly-YYYYMMDD-<short> (prerelease, content-addressable, the unit of history),
  • nightly (rolling channel pointer, body carries sha=/short=/built_at=),
  • latest (legacy alias, kept one cycle so existing camera sysupgrade clients on the old hardcoded URL don't break).
• BUILD_ID / BUILD_SHA in /usr/lib/os-release — emitted from general/scripts/rootfs_script.sh. Local make BOARD=… builds keep working via a local-YYYYMMDD-<hash> fallback. The buildroot job exports BUILD_ID/BUILD_SHA from preflight outputs at the job level so the rootfs script sees them and so the Telegram caption can reference them.
• Telegram caption — now leads with Build: nightly-YYYYMMDD-<short> (the Tag: ${TAG_NAME} line is gone because the now-dead workflow-level env: TAG_NAME: latest was removed).

This PR is reviewable as ~70 lines of YAML + 2 lines of shell. Subsequent PRs (sequenced):

• PR-B: manifest aggregator on gh-pages + retention sweep
• PR-C: sysupgrade --channel/--build/--list-builds (pure busybox)
• PR-D: host-side contrib/openipc-bisect (independent)
• PR-E: build-one.yml accepts arbitrary commit (independent)
• PR-F: image.yml downstream of build.yml via workflow_run

Notes for reviewers

• First-run safety. When the rolling nightly release doesn't exist yet, gh release view nightly errors, PREV is empty, and the gate falls through to build. The first cron after merge always builds.
• Tag pollution on revert. Reverting this PR after some nightly-* releases have been published leaves those tags orphaned. They're harmless (no consumer yet — PR-B introduces the manifest), but happy to add a contrib/cleanup-nightly-tags.sh one-shot in a follow-up if you'd prefer a clean revert path.

Test plan

• CI runs on this PR (event pull_request) and the full ~90-board matrix completes — proves the gate doesn't break the non-schedule path.
• After merge, manual workflow_dispatch produces both a dated nightly-YYYYMMDD-<short> release and updates the rolling nightly (check release bodies contain sha=).
• After merge, the next scheduled cron (with no new commits) takes the skip branch — only Preflight job appears in the run, ~10s.
• Flash one lab camera with an artifact from the dated release; cat /etc/os-release | grep BUILD_ shows BUILD_ID=nightly-… and BUILD_SHA=<40-hex>.
• Telegram caption on the next published build leads with Build: nightly-….

🤖 Generated with Claude Code