ci(release): nightlies system (cron + dispatch, nightly channel) (#592)

[MichaelTaylor3d]

Task

Fan out the VALIDATED nightlies release system (reference: DIG-Network/dig-updater #590/#15) to dig-node. Superproject issue DIG-Network/dig_ecosystem#592 (child of epic #590). Release-infra change — do NOT merge; hand to the review gate.

What changed

• Tagger converted changelog-tag.yml → nightly-release.yml: schedule: 0 0 * * * (midnight UTC) + workflow_dispatch (channel, force). Removed push: branches: main. Preserves version-detect ([workspace.package].version), skip-if-tagged idempotency, git-cliff changelog, RELEASE_TOKEN push, loop guard, no-op-if-absent.
• Nightly channel: dated nightly-YYYYMMDD + rolling nightly, prerelease, never latest, keep-14 (anchored filter + --cleanup-tag), delete-then-upload.
• Reusable build-binaries.yml (workflow_call, version+ref) preserves the dual asset naming (dig-node-* canonical + dig-companion-* legacy) + the dign first-class alias + the ENOSPC debuginfo-strip env. Both release.yml (now tag-only) and the nightly channel call it.
• R1 force-guard: refuses force-move when a PUBLISHED release exists AND the tag commit differs from HEAD.
• opus notes: stable checkout pinned to ref: main; force-branch comment notes tag-immutability break + that the dig-updater signed feed is dig-node's integrity layer.
• A3: un-swallowed gh release list.
• Guard test nightly_release_workflow_shape.rs (11). The build moved out of release.yml, so the existing release_workflow_dign_guard.rs now reads build-binaries.yml.
• SPEC §11 rewritten for the nightlies system + runbooks/release.md added (incl. R2 60-day cron auto-disable recovery).

Version

0.31.1 → 0.31.2 (ci → patch). Cargo.lock synced (cargo update --workspace; only dig-node-service inherits the workspace version).

Per-repo deviations from the template

• Release-path check is now fmt+clippy only — the old release.yml check job also ran cargo test --locked, but its own header already documented the #489 intent to drop it (a deploy-time test re-run is redundant flake-exposure). ci.yml runs the full cargo llvm-cov nextest --workspace on every PR, so coverage is unaffected. Flagging as a (documented-intent) behavior change on the release path.
• opus-note-3 (CI build coverage): ci.yml is ubuntu-latest only — it does NOT build the Windows/macOS release targets on PR (the workspace pulls openssl-sys/wasmtime; a cross-OS CI matrix would be heavy). A midnight stable tag could be cut from a main whose per-OS build was never exercised by PR CI. The nightly channel mitigates this (builds all 4 targets from main HEAD nightly, ~24h detection lag). Documented in SPEC §11 + the runbook; widening ci.yml is filed as a follow-up.
• Updated an existing test: release_workflow_dign_guard.rs now include_str!s build-binaries.yml instead of release.yml (the build relocated). Non-pure-copy change, flagged.
• Local cargo test could not compile the crate on my Windows box (a cmake-based native dep has no local C toolchain) — the guard test is text-only and byte-identical to dig-relay/dig-dns (which passed); CI has the full toolchain and is the verification of record.

Verification

• All three workflow YAMLs parse clean.
• Guard-test logic verified via the identical dig-relay/dig-dns runs; dig-node CI is the compile-of-record.

🤖 Generated with Claude Code

https://claude.ai/code/session_014CHdgyC9V2Lhhwhuxk3e3r