ci: expand validation and add green-main macos tip nightly

[morajabi]

Scope

Adds broad PR and main validation for Inline's Apple clients, server, Rust workspace, shared TypeScript packages, release tooling, and public integrations. The eight small Swift packages run together in one utility job. Candidate npm tarballs are installed by Node 20 and 26 consumers, admitted into installed OpenClaw and Hermes hosts, and exercised against a local Inline server through the packed Bot Client, Chat SDK adapter, and realtime SDK.

Adds a nightly macOS tip workflow modeled on Ghostty's moving tip release. It selects only the current main SHA after its CI, Apple validation, server tests, CodeQL, and any triggered CLI build pass. It uses Inline's existing signed/notarized DMG and Sparkle/R2 publication path, requalifies immediately before public mutations and tag movement, then verifies the GitHub tag and release asset against the signed feed and published DMG bytes. Conditional R2 PUT protects immutable DMGs from concurrent manual releases; exact-byte retries remain recoverable.

Validation

• Exact PR head 9da5fbb54e915026a8cc883f7e381b69ec22ef16: all 34 hosted checks passed, including Apple package batches, unsigned macOS and generic-device iOS Debug/Release builds, server tests, Rust, CLI, plugin admission, packed local-server integration, protocol drift, workflow contracts, and CodeQL.
• Hosted failures found and fixed timing assumptions in RTC, MacScripting, and tooltip tests. The final exact-head Apple package jobs passed. Diagnostic artifact uploads are best-effort because GitHub's artifact service independently timed out; build, test, and audit steps remain required.
• Lightweight local Python gate tests, Bun workflow/release tests, TypeScript typecheck, Swift syntax parsing, and whitespace checks passed. No local simulator, Docker run, or heavy Xcode/Rust build was used.

Live qualification

• Squash merge 198695ca5e6410758d4c8e140e90a4b33ecaf0e7 passed CI, Apple Validation, Server Tests, CLI Build, and CodeQL Actions analysis on main.
• First manual nightly run 36223046060 selected that exact green SHA, signed/notarized/stapled build 5828, passed Gatekeeper, published the DMG and Sparkle feed, and verified the GitHub tip tag/asset against the downloaded R2 DMG. The asset is 32,653,140 bytes with SHA-256 37849ed99e07cbfe2b46a91f2225cb04b9c86aec1f532e690883cbaee19538bc.
• Follow-up run 36223954540 reported already published: True and skipped the release job, proving unchanged-main idempotence.
• Optional Sentry dSYM upload was skipped because SENTRY_AUTH_TOKEN is not configured in the repository. Latest OpenClaw compatibility remains advisory if upstream latest changes; pinned versions are required.