[th3-br41n]

Adds a scheduled nightly builds pipeline (.github/workflows/nightly.yml) — no Apple/Windows certificates yet.

What it does

• Triggers: schedule 0 7 * * * UTC + workflow_dispatch. concurrency: nightly (newer run supersedes).
• Matrix: mac/win/linux × x64/arm64 (runner/arch/native columns mirror ci.yml/release.yml).
• Unsigned, certless: the package step omits every CSC_*/WIN_CSC_* var and sets CSC_IDENTITY_AUTO_DISCOVERY=false → macOS ad-hoc-signs (no notarize; build config already has hardenedRuntime:false/gatekeeperAssess:false), Windows/Linux ship unsigned.
• Publish: installers go to a rolling nightly GitHub prerelease (delete+recreate so stale platform files don't linger).

Arch pinning (the non-obvious bit)

Each job pins electron-builder to its own arch via <target>:<arch>. The shared build config declares arch:["x64","arm64"] per target, so a bare package:* builds both arches on every runner — and the cross-arch half is broken (its native isn't built on that host). CLI --x64/--arm64 flags are ignored when the config sets per-target arch; only the target:arch form overrides it. Pinning keeps published binaries correct and collision-free on merge.

Note: release.yml has the same latent double-arch behavior — not touched here, flagging for follow-up.

Wiring real certs later

Mirror release.yml's CSC_*/WIN_CSC_* env block into the package step and drop CSC_IDENTITY_AUTO_DISCOVERY (noted in the file header).

Testing

• actionlint clean (only the pre-existing macos-13 "unknown label" note that ci.yml/release.yml also emit).
• Ran the real certless electron-builder --mac locally (arm64): ad-hoc signature, notarization skipped, valid .dmg/.zip, exit 0.
• Verified target:arch produces single-arch output and the collect glob stages only installers (no .blockmap/.yml/unpacked dirs).
• Full matrix + GitHub-release publish run only on Actions (can't exercise locally).

🤖 Generated with Claude Code