ci(nightly): fix nightly flake and smoke-test the shipped artifacts before pushing unstable - #759

What

Adds three smoke jobs to nightly.yml that download the just-built release artifacts and prove the shipped bytes actually run — a daemon boots, a microVM boots, a session round-trips — before the nightly channel is advanced. Each downloads the uploaded artifacts by name, puts the shipped binaries on PATH (never a fresh target/ build), and runs the ONE shared session e2e (scripts/session-e2e.sh, the same proof the CI lanes run).

This PR also carries two related nightly fixes as separate commits:

1. nightly startup_failures: #757's verify-ci gate requests checks: read, a called workflow cannot hold a scope its caller doesn't grant, and nightly.yml granted only contents: write + id-token: write — so every scheduled run since ci(release): verify-ci gate, dry_run, --locked, arm64 recollapse #757 merged (Jul 15, Jul 16) died at workflow compile time and no nightly was cut. Manual release.yml dispatches kept working (a directly-dispatched workflow uses its own permissions), which is why it went unnoticed. nightly.yml now grants checks: read.
2. session-e2e-soak failing 10/10 (nightly-tests.yml): #760's deepened e2e clones the pkgs upstream inside the guest, and test: prove the in-sandbox min add path via interactive PTY attach on every lane #760 staged gvproxy on the KVM and macOS lanes but not on the soak — so minvmd boots the soak's VM switchless and every iteration dies with "Could not resolve host" (first seen Jul 16, the first scheduled run after test: prove the in-sandbox min add path via interactive PTY attach on every lane #760). The soak now runs fetch-gvproxy.sh and sets MINVMD_GVPROXY_BIN, exactly as the KVM lane does.

The three smoke jobs

Needs-graph (how smoke gates the channel flip)

check ─► release (workflow_call: release.yml — builds, signs, stages, publishes)
              │
              ├─► smoke-linux-amd64 ─┐
              ├─► smoke-linux-kvm ───┤
              └─► smoke-macos ───────┤
                                     ▼
                        smoke-success (if: always())
                                     │
check, release ──────────► promote-nightly ◄─┘   (flips the nightly channel)

• The workflow_call jobs are part of the caller's run, so the smoke jobs download the artifacts release.yml's build jobs uploaded, by the same names, with no cross-run plumbing.
• Smoke blocks the channel advance, not the build. promote-nightly now needs smoke-success and requires it to be success. A red smoke means nightly keeps serving yesterday's proven build. Note the trade-off vs the release.yml placement: the GitHub release + GCS staging inside the called workflow complete before the smoke verdict — only the channel flip is gated.
• smoke-success is skip-tolerant, mirroring the repo's *-success lane aggregators: if: always(), reds only on contains(needs.*.result, 'failure'|'cancelled'). A skipped smoke reads as pass; a real failure/cancellation reds it and blocks the flip.
• No-op nights stay no-ops. When HEAD is already staged, release skips, all three smokes skip with it (plain needs: [release]), smoke-success passes vacuously, and promote-nightly re-points the channel at bytes that were smoked the night they were cut.
• mac smoke stays skip-tolerant. smoke-macos is gated on the same vars.RUN_MACOS_CI != 'false' kill-switch as the mac build/sign jobs. Taking the mini offline skips it as skipped (not failure), and the nightly still advances on the two Linux proofs.