ci: add nightly build workflow

[owainlewis]

Summary

• add a manually runnable and scheduled Nightly workflow
• build the macOS release binary from main
• upload clearly named nightly artifacts plus checksum as GitHub Actions artifacts
• keep permissions read-only so stable tag releases are not modified

Verification

• Ruby YAML parse for .github/workflows/nightly.yml
• local cargo build --release
• local packaging smoke test: created nightly tarball, verified checksum, unpacked binary, ran cortex --version
• subagent review found no issues

Notes

• actionlint is not installed locally
• the workflow still needs to be run manually after merge because GitHub only exposes new workflow_dispatch workflows from the default branch

Closes #37