ci: run the full ci workflow nightly on main (PMAT-2166)

[noahgift]

Closes #2166.

xpile had no scheduled workflow. ci, book and release run only on push, pull request or tag, so an idle main never saw drift in the stable toolchain, crates.io installs or the advisory DB. For comparison, depyler's nightly went red on every target when provable-contracts-cli 0.4.0 dropped its binary.

Change: add schedule (daily at 06:23 UTC) and workflow_dispatch to .github/workflows/ci.yml. Every job runs unchanged against main. No job reads github.event_name, base_ref or head_ref, so the scheduled run is the same gate a push runs. Also registers PMAT-2166 in docs/roadmaps/roadmap.yaml.

Verified locally: the 8 tests that read ci.yml or git history pass (witness_floor, dependency_license_policy, ci_tool_install, derived_corpus_vacuity_witness, release_runbook_facts_witness, ruleset_drift, roadmap_registration, changelog_freshness), as do pv lint contracts/, cargo deny check advisories and the pre-commit clippy.

Note: pmat work add put the roadmap entry in the middle of PMAT-1414's multi-line description scalar, which corrupted the YAML. The entry here was appended by hand and parses.

🤖 Generated with Claude Code

[noahgift]

quorum-review (AD-04): three PASS — agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-2166",
 "head": "6d81cd44441536ce803d9d27bf2532aa90c8bb34",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}

[noahgift]

APPROVE — seat 1, aprender-a7, head 9253510

Read the full diff at this head; every check is green on it.

• .github/workflows/ci.yml: adds schedule: '23 6 * * *' and workflow_dispatch only. No job in the file has an if: on event or ref, and none deploys or uses secrets, so a scheduled run is the same job set a push to main runs. It does not change what a PR or the merge accepts.
• docs/audits/quorum-PMAT-2166.json follows the existing docs/audits/quorum-*.json pattern on main. docs/roadmaps/roadmap.yaml adds the PMAT-2166 row.

Non-blocking: when a nightly run goes red on an unchanged main, someone has to own it the same day, or the red sits there until the next PR finds it. Worth naming the owner in PMAT-2166.

[noahgift]

seat 2, aprender-clerk @92535106a6 — APPROVE.

I authored none of these commits (6d81cd4, f674c48, merge 9253510; all by infra-38-worker).

• ci.yml adds only triggers: schedule cron '23 6 * * *' and workflow_dispatch, next to pull_request and push. No job reads github.event.pull_request, base_ref/head_ref or event_name, so every job runs unchanged on the nightly trigger. No job gains an if: or continue-on-error, so there is no third state on the PR path.
• docs/audits/quorum-PMAT-2166.json follows the existing in-tree receipt convention (docs/audits/quorum-PMAT-21xx.json). The roadmap adds rows only.
• The two-dot diff against main covers exactly these 3 files after the merge.
  Required checks gate and workspace-test are green @92535106a6.