feat: add Desktop Nightly update channel

[Astro-Han]

Summary

Add a developer-only Desktop Nightly channel that builds the exact scheduled main commit for macOS arm64 and Windows x64 without participating in the ASF source-release vote.

Each fresh workflow run owns one immutable 0.2.0-dev.YYYYMMDD.run version. Publication is append-only: verified versioned payloads are uploaded first, then the independent macOS and Windows feeds advance. In-place workflow reruns are rejected; a failed Nightly is retried with a fresh dispatch and therefore a fresh version.

Nightly packages embed an isolated Apache Nightlies feed, accept only newer dev versions, and verify downloaded bytes against Sigstore provenance issued by the Nightly workflow on main. Publishing uses the protected nightly Environment and the hosted runner's rsync with an Infra-verified known_hosts entry; no third-party deployment action receives the SSH key.

The workflow remains disabled until Apache Infra publishing, retention ownership, and the protected nightly Environment are configured.

Verification

• node --test --test-concurrency=1 scripts/desktop-nightly.test.mjs scripts/desktop-nightly-stage.test.mjs scripts/desktop-nightly-workflow-policy.test.mjs scripts/ci-test-plan.test.mjs scripts/verify-windows-harness.test.mjs (98 passed)
• Focused bundled tests for app-update-service.test.ts and app-update-attestation.test.ts (18 passed)
• node --test --test-name-pattern='Desktop packaging derives|platform package verifiers' scripts/product-release.test.mjs (2 passed)
• actionlint .github/workflows/desktop-nightly.yml
• Biome checks and git diff --check
• tsc -p apps/desktop/tsconfig.main.json --noEmit remains blocked by existing stale workspace/test types unrelated to this diff (llmConnectionId, SessionConfigurationPatch, and MCP store exports).

Rollout

• Apache Infra whitelists apache/maka for Nightlies publishing, supplies an authenticated SSH known_hosts entry, and confirms whether retention is service-managed or project-managed.
• Create the nightly Environment restricted to main; store all Nightlies rsync and Apple signing/notarization secrets there.
• After merge and external setup, set DESKTOP_NIGHTLY_ENABLED=true.
• Run two fresh manual builds and verify a real automatic update on clean macOS and Windows machines before sharing the channel.

Nightly currently uses the same application identity and user-data location as the formal Desktop, so installing it replaces the existing Maka installation rather than adding a side-by-side app. Clean remote Runtime Host setup remains outside this channel because Nightly does not publish a matching npm package.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented the workflow, channel authority, staging/verification scripts, tests, operations documentation, and adversarial review fixes. The human contributor must review the final diff, provenance, licensing, and rollout configuration before merge.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[M4n5ter]

English

I found two blockers:

1. Failed-job reruns bypass the immutable-version guard.

   The github.run_attempt != 1 check exists only in the identity job. GitHub also allows rerunning failed or specific jobs. If identity succeeded but desktop or publish failed, rerunning the failed job does not execute the guard again and can reuse the same version.

   This allows a partially published version directory to be completed or overwritten in place before advancing the feed, violating the append-only contract.

   Please make every build/publish job independently reject github.run_attempt != 1, and update the workflow-policy test to cover failed-job and specific-job reruns.

2. An enabled Nightly fails its own release-contract check before packaging.

   MAKA_DESKTOP_NIGHTLY_VERSION is set for the entire desktop job. Both platform packaging wrappers run npm run check:release, whose product-release.test.mjs imports the environment-sensitive default electron-builder config but still expects the formal release configuration.

   This reproduces with:

   MAKA_DESKTOP_NIGHTLY_VERSION=0.2.0-dev.20260829.42 \
     node --test \
     --test-name-pattern='Desktop packaging derives|platform package verifiers' \
     scripts/product-release.test.mjs
   

   The test receives makaUpdateChannel: 'nightly' and the Nightly version while expecting makaUpdateChannel: 'release'.

   Please make the formal release-contract test resolve its configuration with an explicit environment, rather than ambient process.env, and add coverage that runs the packaging checks under the Nightly environment.

Given the clarified product contract—only ASF-approved stable releases and developer Nightlies—I do not consider allowPrerelease being enabled only for Nightly a problem. There is no supported Desktop alpha/beta channel to preserve.

简体中文

我确认了两个阻塞问题：

1. Failed-job rerun 可以绕过不可变版本检查。

   github.run_attempt != 1 只在 identity job 中检查，但 GitHub 还允许单独重跑失败 job 或指定 job。如果 identity 已成功，而 desktop 或 publish 失败，重跑失败 job 时不会再次执行该检查，并且可以继续使用相同版本。

   这会允许原地补全或覆盖已经部分发布的版本目录，然后推进 feed，破坏 append-only 契约。

   建议让每个 build/publish job 独立拒绝 github.run_attempt != 1，并在 workflow policy test 中覆盖 failed-job 和 specific-job rerun。

2. Nightly 启用后会在真正打包前被自己的 release contract check 阻断。

   MAKA_DESKTOP_NIGHTLY_VERSION 被设置在整个 desktop job 上。两个平台的 packaging wrapper 都会执行 npm run check:release；其中 product-release.test.mjs 导入了受环境变量影响的默认 electron-builder config，但仍然断言它是正式发行配置。

   可以稳定复现：

   MAKA_DESKTOP_NIGHTLY_VERSION=0.2.0-dev.20260829.42 \
     node --test \
     --test-name-pattern='Desktop packaging derives|platform package verifiers' \
     scripts/product-release.test.mjs
   

   测试实际得到 makaUpdateChannel: 'nightly' 和 Nightly 版本，但期望的是 makaUpdateChannel: 'release'。

   建议让正式发行契约测试使用显式环境解析配置，不再依赖 ambient process.env；同时增加在 Nightly 环境下运行 packaging checks 的覆盖。

根据已经澄清的产品契约——只有完整经过 ASF 流程的正式版本和仅供开发的 Nightly——我不认为仅为 Nightly 开启 allowPrerelease 是问题。当前没有需要兼容的 Desktop alpha/beta channel。

[Astro-Han]

Fixed both blockers in e841adb1d.

1. Every independently rerunnable job (identity, desktop, and publish) now starts with the same failing github.run_attempt != 1 guard. The workflow-policy test executes and verifies the guard for all three jobs, so failed-job and specific-job reruns cannot rebuild or republish an existing Nightly version.

2. The formal Desktop release contract now calls resolveDesktopBuilderConfig({}) instead of importing the ambient default configuration. I also added a regression test that runs the focused release checks with MAKA_DESKTOP_NIGHTLY_VERSION set.

Verified:

• Nightly and product release contract tests: 38/38 passed
• The reported Nightly-environment reproduction command: 2/2 passed
• actionlint
• Biome
• git diff --check

@M4n5ter, could you please take another look when convenient?

[M4n5ter]

LGTM