feat(release): build fork Nightlies from pinned patch stack

[saphid]

Summary

• poll pingdotgg/t3code every five minutes for a newly published Nightly, with manual and repository_dispatch triggers available
• start from the exact upstream Nightly tag and apply the ordered, pinned stack in .github/downstream-nightly.json
• support pinned pull requests, commits, and refs, and stop if a PR head or ref moves before review
• derive a deterministic Nightly version that sorts after the matching upstream build
• push the assembled source to automation/downstream-nightly, build macOS arm64 and x64, Linux x64, and Windows x64, then publish updater metadata and installers in saphid/t3code
• embed saphid/t3code as the desktop update repository and require generated-source checks, typechecks, tests, and every platform build before publication
• prevent the inherited upstream release workflow from running its Blacksmith publisher on the fork

The initial stack contains the fork search commit, upstream PR pingdotgg#8857, and upstream PR pingdotgg#8976. PR and ref entries pin their reviewed heads. The latest cross-provider and Macroscope review findings on both upstream PRs are included in the pinned revisions.

Verification

• node --test .github/scripts/downstream-nightly.test.mjs: 8 passed
• actionlint .github/workflows/downstream-nightly.yml: passed
• focused formatting and git diff --check: passed
• live assembly from v0.0.38-nightly.20260831.1241: passed, including every selected commit and deterministic version generation
• assembled source vp run typecheck: all 15 workspace typechecks passed
• assembled source focused tests: contracts 307, server 53, web 49, desktop 78, mobile 2, all passed

The full assembled-source test run found one existing failure in scripts/build-desktop-artifact.test.ts on this Apple Silicon host. That test and its implementation are unchanged from the exact upstream Nightly tag. The fork workflow runs its quality gate on Ubuntu x64, matching the upstream release quality environment.

Setup and limits

• Scheduled workflows only run from the default branch, so automation starts after this PR is merged.
• The fork currently has no Actions signing secrets or signing variables. Builds will be unsigned until the Apple and Azure settings documented in .github/DOWNSTREAM_NIGHTLY.md are configured. An unsigned or differently signed build cannot automatically replace the installed upstream-signed macOS app.
• This publishes desktop artifacts only. It does not publish the t3 npm package, deploy web, or update AUR.
• Existing queued runs from the inherited release workflow may be canceled after merge. New inherited runs will skip on the fork.