feat(ci): cut the stable desktop release every night

[charlesvien]

Problem

Stable desktop releases are manual. Every Publish run since July was a workflow_dispatch, so a fix that lands on main reaches stable-channel users only when someone clicks Run workflow. The nightly cron only produced pre-releases, which nightly-channel users see and nobody else does.

Changes

publish.yml now also runs at 03:00 UTC. The scheduled run is gated on main being ahead of the latest stable release (/releases/latest plus the compare API), so a quiet night builds nothing and a night the cron misses is caught up the next night. Dispatch and tag pushes build unconditionally, as before.

nightly.yml is deleted. Keeping it would build the same commit twice a night under two version numbers. The full matrix ships every night now (macOS arm64+x64 signed and notarized, Windows, Linux), which also closes the "Intel install can hit updater errors when the newest release is an arm64-only nightly" gap from the roadmap.

A concurrency group queues a manual dispatch behind a scheduled run: the version job reads the release list at run time, so two runs in flight would stamp the same version and race to create one release.

The in-app channel picker becomes a no-op (both channels get the same nightly stable build). Left in place for now so a pre-release track can come back without a client change. Happy to remove it in a follow-up.

No new secrets: the scheduled path runs with the signing and notarization secrets Publish already has. Docs updated (CLAUDE.md, SESSIONS, ROADMAP).

How did you test this code?

actionlint on the workflow. Ran the gate script verbatim against the live repo: as schedule on origin/main it resolves v0.2.51 (ignores the v0.2.52 pre-release) and reports 3 commits ahead, so tonight's run would build; on the v0.2.51 commit itself it skips; as workflow_dispatch it builds without calling the API.

Not dispatched from this branch: that would cut a real stable release, and the fork has no signing secrets. The first live exercise is the first cron after merge, or a manual Run workflow, which takes the same path minus the gate.