🔬 Add Sparkle update channels and nightly macOS release publishing

[Robdel12]

Summary

Adds a channel-aware Sparkle update system for the macOS app with three channels: stable, beta, and nightly.

• App-side channel model — UpdateChannel enum with per-channel feed URLs, Sparkle channel IDs, and appcast filenames. AppUpdaterDelegate implements feedURLString(for:) and allowedChannels(for:) to route Sparkle to the correct feed at runtime.
• Runtime channel selection — Users choose their channel in Preferences → Workspace → Updates. Persisted in UserDefaults, applied immediately to Sparkle's delegate.
• Separate appcasts — Each channel has its own appcast file (appcast.xml, appcast-beta.xml, appcast-nightly.xml). Stable users never see non-stable builds.
• Channel-aware scripts — Both archive-macos-app-release.sh and generate-sparkle-appcast.sh accept a CHANNEL env var that auto-configures the correct feed URL and appcast filename.
• Automated nightly workflow — .github/workflows/nightly.yml runs daily at 06:00 UTC. Computes a date-stamped version (e.g. 0.4.0-nightly.20260324), archives/notarizes the app, generates appcast-nightly.xml, and publishes to a rolling nightly GitHub prerelease.
• Documentation — Updated docs/DEPLOYMENT.md with the channel model, feed URLs, manual vs automated flows, and required repository secrets.

Design decisions

• Separate appcasts over single feed with channel tags — Simpler, no Sparkle channel filtering needed, each feed generated independently.
• Runtime channel switching, not build flavors — One binary, user picks channel in preferences. The SPUUpdaterDelegate.feedURLString(for:) method returns the URL for the selected channel.
• Nightly versioning — <base>-nightly.YYYYMMDD with monotonically increasing build numbers. Sparkle sorts by build number, so nightlies sort correctly without breaking stable release progression.
• macOS-only — Beta/nightly channels are macOS-only for now. Linux/server release flows unchanged.

Required secrets for nightly CI

The workflow needs these repository secrets configured before it will run:
SPARKLE_PUBLIC_ED_KEY, SPARKLE_PRIVATE_ED_KEY, MACOS_DEVELOPMENT_TEAM, APPLE_NOTARY_KEY_ID, APPLE_NOTARY_ISSUER_ID, APPLE_NOTARY_PRIVATE_KEY

Test plan

• macOS build succeeds (xcodebuild build — verified)
• iOS build succeeds (xcodebuild build — verified)
• Manual: open Preferences → Workspace, verify "Updates" section with channel picker appears
• Manual: switch channel, quit/relaunch, verify channel persists
• Manual: run CHANNEL=nightly ./scripts/generate-sparkle-appcast.sh and verify appcast-nightly.xml output
• CI: nightly workflow runs successfully after secrets are configured

Closes #139