feat(ci): ship stable releases from the latest nightly commit

[t3dotgg]

We merge hundreds of PRs a day. By the time a nightly is verified, main has moved on, so cutting a stable from main HEAD ships code nobody has run. Pausing merges is not an option at this rate.

Now a manual stable release builds the commit of the latest published nightly instead of main HEAD. Nightly is the release candidate. Verify it, dispatch the Release workflow with channel=stable, and the stable build is byte-for-byte the code nightly users already ran. Merges keep landing the whole time.

Details:

• A resolve_commit job runs first on every trigger and picks the commit every later job checks out. Schedule and tag push still build the triggering commit.
• Stable dispatch looks up the newest published nightly release, dereferences its tag to a commit, and builds that. The run posts a notice naming the nightly tag and commit so you can confirm it matches what you verified.
• The version defaults to the one the nightly previewed, so v0.0.39-nightly.* ships as 0.0.39. The version input still overrides it.
• Pushing a vX.Y.Z tag by hand is unchanged and still builds exactly that commit, for cherry-picked fixes on a release branch.
• The nightly lookup is shared with the existing nightly gap check, so both agree on which nightly is latest. Tests cover the new resolver.

Created with Claude Fable 5.1 in Claude Code.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.6 KiB	+64 B (+0.5%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	−1 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.6 KiB	+65 B (+1.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.0 KiB	57.1 KiB	+88 B (+0.2%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.6 KiB	−13 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.0 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−12 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	57.8 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	9	8	−1 (−11.1%)	21	✅

Baseline: 7ac93e3 · PR result: 880df9c · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This changes the production release pipeline so manual stable releases promote the latest published nightly across desktop, npm, GitHub, AUR, and hosted web deployments instead of building the current dispatch commit. The broad change in release provenance and deployment behavior warrants human review.

Not approved because:

• Monthly spending limit reached (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}