ci: add nightly pre-release workflow

Publish nightly multi-architecture pre-release images to GHCR from master
so users can test recent changes without building from source.

- Runs at 03:00 UTC daily, plus manual dispatch with a `force` input
- Skips the build when master has no new commits since the `nightly` tag
- Runs Go unit tests (cluster-dependent suites excluded) before building
- Builds linux/amd64 and linux/arm64 on native runners, publishing by
  digest and joining them into one manifest, mirroring the CI release path
- Tags images `nightly` and `nightly-YYYYMMDD`, and idempotently moves the
  matching git tags via the GitHub API so re-runs are safe

Closes #852

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Spec-Ref: helix-specs@a0026ccc:000340_lets-implement