feat(ci): ship Thuki Nightly as side-by-side signed install

[quiet-node]

Overview

Nightly builds install as a separate app next to stable, with the same RSA-signed DMG path the curl installer already trusts.

What changed

• Nightly CI patches productName to Thuki Nightly and identifier to com.quietnode.thuki.nightly, and turns the in-app updater off for that build.
• Nightly CI signs Thuki.dmg with THUKI_INSTALLER_RSA_PRIVATE_KEY and uploads Thuki.dmg.sig on the floating nightly prerelease.
• Keychain service is scoped by bundle id so nightly does not share provider API keys with stable.
• README documents the nightly one-liner (script lives on thuki.app; channel support is a landing follow-up).

How to install (after landing deploys channel-aware install.sh)

# stable
curl -fsSL https://thuki.app/install.sh | sh

# nightly
curl -fsSL https://thuki.app/install.sh | THUKI_CHANNEL=nightly sh

Nightly lands as /Applications/Thuki Nightly.app.

Testing

• cargo test --lib keychain:: (7 passed)
• Workflow YAML and jq identity patch reviewed manually
• Full macOS nightly job validates create-dmg + sign + upload on first green run after merge

Note

Until the first post-merge nightly run finishes, the nightly release will not yet include .sig. Landing-page install.sh channel support is separate and should deploy after or with that run.