chore: collapse stable + nightly into one rolling auto-ship lane

[arzafran]

What this does

Programa now ships on a single lane instead of two. Every commit on main that passes CI is automatically built, signed, notarized, and published — no more separate nightly channel, no manual tagging to ship. If something breaks, we fix it forward on main and the next green build ships the fix.

To keep the releases page clean, auto-ship publishes to one reused rolling release that's overwritten each time (rather than a new release per commit). Permanent vX.Y.Z milestone tags still work for marking versions.

Summary

• Trigger: release.yml now runs on workflow_run after the CI workflow succeeds on main (gated on conclusion == success), and pins checkout to the exact commit CI validated (head_sha). The v* tag push and workflow_dispatch dry-run paths are kept.
• Rolling release: auto-ship reuses a single rolling release — force-moves the tag to the shipped commit, overwrites assets, marks it "latest" so releases/latest/download/* always resolves to the newest green build. Milestone v* tags publish permanent releases and remain protected by the immutable-asset guard (auto-ship skips that guard on purpose).
• Build-number fix: CFBundleVersion / sparkle:version is now always the monotonic GitHub run ID for both auto-ship and milestone tags. Previously milestone tags used the small committed build number, which would have silently failed the monotonic guard (and Sparkle) once auto-ship published run-ID-scale numbers.
• Nightly removal: deleted nightly.yml + the nightly command files, removed nightly Sparkle-feed detection from UpdateDelegate, the nightly bug-report dropdown, the CLI's dead nightly.yml signer reference, and stale nightly refs in CI guard tests + daemon docs. No nightly users existed, so it was deleted outright.

Test plan

• Dry-run first: trigger release.yml via workflow_dispatch — it should build + notarize and upload an artifact without publishing a release or moving any tag.
• CI (ci.yml) green on this branch (unit, workflow-guard tests, ui-regressions).
• After merge: confirm the first green-CI run on main publishes/overwrites the rolling release, marked latest, with a run-ID build number.
• Confirm an installed older build auto-updates via Sparkle from the single feed.

⚠️ Merging this enables live auto-ship. The first green CI run on main after merge notarizes and ships to all users. Run the workflow_dispatch dry-run before merging.