Give the desktop a nightly channel, the way the phone has one

ADR 0014 gave the phone a nightly and ADR 0013 rule 3 gave the desktop none, so
the two heads had different answers to the same question — how does somebody try
what is on main? — for no reason except the order the work happened in. This is
the desktop's answer: CI publishes a build from main on every push, and it
installs beside the release one rather than over it.

The phone gets its separation from the platform. Android refuses an update signed
by a different key, so its two channels cannot replace one another whatever
anybody does. Nothing refuses anything here: Velopack applies what its feed serves
and verifies no signature. So all of it is construction, and there are four
separations because each closes a different door.

A pack id each, so the two install in different directories and neither feed's
package can be applied to the other's install. A Velopack channel each —
win and win-nightly — so neither build ever reads the other's release index; the
name reaches the wire as releases.win-nightly.json, which is why the constant in
VelopackUpdateChannel and the argument in ci.yml have to agree or the channel
answers nothing forever with no error. A prerelease flag, so the release channel
cannot see the nightly even by accident. And a profile directory each, which is
the one that is easy to skip and would hurt most: the cache schema is migrated on
every launch, before unlock, so a shared profile means a nightly quietly upgrading
a database the release build then opens. Both are installed at once by design, so
that is an ordinary Tuesday rather than a corner case.

The prerelease flag turns out to be load-bearing across heads as well. The phone's
release channel reads releases/latest, which skips prereleases — so a desktop
nightly published as a stable release would become the newest release in this
repository and every phone on the release channel would start failing its check
against a release carrying no Android manifest.

Which build this is arrives as assembly metadata, the same mechanism and the same
reasoning as the Android head: the updater needs the string rather than a branch,
and a value baked into the assembly is one a crash report can be asked for. Three
things read it — the feed, the prerelease flag, and the profile — and one more
shows it: the titlebar says DodoSSH Nightly. Everything else that distinguishes
the two is somewhere nobody is looking while typing a passphrase into one of them.

The version needed a floor and it is applied to the whole build rather than to the
packaging. MinVer answers 0.0.0-alpha.0.N until the first v* tag and vpk refuses
anything below 0.0.1, so the job lifts the patch digit and keeps the height —
through MinVerVersionOverride, so the assemblies carry the same number the
installer does. Packing a version the assembly disagreed with would put one string
on the preferences screen and another in the feed, which is the screen somebody
reads when asked which nightly they are on.

Two things found by running it rather than reading it. -t:MinVer needs a restore
first, because the target arrives with the package and MSB4057 on a clean checkout
reads like a typo in the workflow rather than a missing restore; the release
script had the same gap and now restores before it reads. And vpk rejects an empty
--packVersion loudly, which is how a broken version handoff announces itself
rather than shipping a package called 1.0.0.

Rule 3 is untouched. The release channel still has no job, no token and no runner,
and the two channels cannot see each other. What a nightly costs is written where
somebody reads it before installing one: whoever can write a release here can put
a build on every nightly machine, which is fine for a build being tried and is not
fine for a build holding somebody's infrastructure credentials.

Verified by running the job's own steps against a clone in a Linux container:
DodoSSH.Desktop.Nightly-win-nightly-Setup.exe, and an index naming pack id
DodoSSH.Desktop.Nightly at 0.0.1-alpha.0.144. The upload itself is the one step
not exercised — it needs a real forge and a write token, and check 16.10 is what
walks the half no runner can.

src/DodoSSH.Client.Session/ClientPaths.cs

@@ -23,8 +23,60 @@ public sealed record ClientPaths(string DataDirectory)
     private const string WindowsFolderName = "DodoSSH";
     private const string UnixFolderName = "dodossh";
 
+    /// <summary>
+    /// The channel whose profile is kept apart, named here because this type is the one that acts on it.
+    /// </summary>
+    /// <remarks>
+    /// The string itself is the desktop head's <c>DesktopChannel.Nightly</c>. It is repeated rather than
+    /// referenced because the dependency runs the wrong way — this project is shared with the Android
+    /// head, which must never acquire a desktop updater — and because a value that reaches an assembly as
+    /// build metadata is a string by the time anybody here sees it.
+    /// </remarks>
+    private const string NightlyChannelName = "nightly";
+
+    /// <summary>
+    /// What the nightly's directory is called: the release one, with this on the end.
+    /// </summary>
+    /// <remarks>
+    /// A sibling rather than a subdirectory of the release profile, so that neither install's uninstaller
+    /// or reset can reach the other's, and so a person looking in <c>%LOCALAPPDATA%</c> sees two things
+    /// with two names rather than one thing with a surprise inside it.
+    /// </remarks>
+    private const string NightlySuffix = ".Nightly";
+
     /// <summary>The conventional location for this platform.</summary>
-    public static ClientPaths Default { get; } = new(ResolveDataDirectory());
+    public static ClientPaths Default { get; } = new(ResolveDataDirectory(suffix: null));
+
+    /// <summary>
+    /// Where a build on the given channel keeps its profile.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// <b>A nightly may not share a profile with the release build, and the reason is the cache rather
+    /// than the secrets.</b> The schema is migrated on every launch, before unlock; a nightly carrying a
+    /// migration the release build has not shipped yet would upgrade a database the release build then
+    /// opens. Both are installed at once by design — that is the whole point of a channel that installs
+    /// beside rather than over — so this is an ordinary Tuesday rather than a corner case. Two of them
+    /// running at the same time on one SQLite file and one outbox is the second reason and would be
+    /// enough on its own.
+    /// </para>
+    /// <para>
+    /// It costs a nightly its sign-in and its known hosts, which is the honest trade: a nightly is a
+    /// second installation of the application, and treating it as one is what stops it damaging the first.
+    /// The device key is per install too, so the deployment sees a new device — which is exactly what
+    /// happened, and what the trust model expects to be told about.
+    /// </para>
+    /// <para>
+    /// Only the nightly channel is answered specially. Anything else, including the release channel and
+    /// anything unrecognised, gets <see cref="Default"/> — the directory every existing install already
+    /// uses, which must not move for any reason.
+    /// </para>
+    /// </remarks>
+    /// <param name="channel">The build channel, as the head's own metadata reports it.</param>
+    public static ClientPaths ForChannel(string? channel) =>
+        string.Equals(channel, NightlyChannelName, StringComparison.Ordinal)
+            ? new ClientPaths(ResolveDataDirectory(NightlySuffix))
+            : Default;
 
     /// <summary>The encrypted local cache.</summary>
     public string CacheFile => Path.Combine(DataDirectory, "cache.db");
@@ -68,20 +120,25 @@ public sealed record ClientPaths(string DataDirectory)
     /// here is one line versus depending on whether the runtime happens to.
     /// </para>
     /// </remarks>
-    private static string ResolveDataDirectory()
+    private static string ResolveDataDirectory(string? suffix)
     {
+        // Appended to the folder name rather than added as a path segment, on every platform, so the two
+        // profiles are siblings everywhere. The Unix name is lower-cased with the rest of its folder.
+        var windows = WindowsFolderName + suffix;
+        var unix = UnixFolderName + suffix?.ToLowerInvariant();
+
         if (OperatingSystem.IsWindows())
         {
             return Path.Combine(
                 Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
-                WindowsFolderName);
+                windows);
         }
 
         var home = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
 
         if (OperatingSystem.IsMacOS())
         {
-            return Path.Combine(home, "Library", "Application Support", WindowsFolderName);
+            return Path.Combine(home, "Library", "Application Support", windows);
         }
 
         var xdgDataHome = Environment.GetEnvironmentVariable("XDG_DATA_HOME");
@@ -90,6 +147,6 @@ public sealed record ClientPaths(string DataDirectory)
             ? Path.Combine(home, ".local", "share")
             : xdgDataHome;
 
-        return Path.Combine(root, UnixFolderName);
+        return Path.Combine(root, unix);
     }
 }