pkg: nightly integration run — real veloxd + testserver, 50 concurrent

Adds tests/integration/nightly_run.py, wired as the nightly-integration job in
ci.yml (schedule + workflow_dispatch). Real veloxd + tools/testserver, 50
concurrent downloads mixing flaky-reset/throttled/no-range/plain, asserting:
every completed file's SHA-256 against testserver's own /sha256/ route (never
trusting veloxd's own success claim), every task reaching a terminal state
inside the timeout, and veloxd's own open-FD count settling back to baseline.

veloxd runs isolated (XDG_RUNTIME_DIR/XDG_DATA_HOME/XDG_CONFIG_HOME under a
fresh mkdtemp — not the session scratch dir, whose path overflows AF_UNIX's
sun_path). saveTo.allowedRoots is seeded directly into velox.db after a
migrations-only warm-up start, since settings.set returns -32603 'not
implemented in this build' on the veloxd this job builds (verified live).

Every task gets its own filename override on download.add: tasks sharing
(mode, size) share a URL, and without distinct filenames they raced each
other's rename on the first real run (48/50 'passed' with io_errors and
checksum mismatches on the collided tasks) before this fix.

Every assertion was forced red once on purpose and the transcript recorded in
tests/integration/README.md, per this repo's history of green checks that
didn't look where the bug was.

Every spawned child (veloxd, testserver.py) gets PR_SET_PDEATHSIG plus its own
process group, so a hard-killed harness can't strand a daemon the way a prior
run did (4h40m under systemd --user, because SIGKILL never reaches a
finally: block). Proven by kill -9'ing a running harness mid-download and
confirming both children exit with it.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RBPR7iM3YPyxrjWsVtZDPJ

.github/workflows/ci.yml

@@ -4,6 +4,9 @@ on:
   push:
     branches: [main]
   pull_request:
+  schedule:
+    - cron: '17 3 * * *'   # nightly-integration only; every other job stays PR/push-triggered
+  workflow_dispatch:        # lets a human fire nightly-integration on demand
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -225,3 +228,23 @@ jobs:
         run: cmake --build --preset dev --target velox_conformance_cpp
       - name: Run conformance (ctest -L conformance)
         run: ctest --preset dev -L conformance --output-on-failure
+
+  nightly-integration:
+    # Real veloxd + tools/testserver, 50 concurrent downloads mixing hostile modes,
+    # every completed file's SHA-256 checked against testserver's own /sha256/ route,
+    # veloxd's open-FD count checked flat across the run. Nightly, not per-PR: it's
+    # ~2 minutes of real network I/O against a local server, not a schema check.
+    # See tests/integration/README.md#nightly-integration-run for what each assertion
+    # catches and the forced-failure transcript proving it isn't vacuous.
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Bootstrap toolchain
+        run: sudo ./tools/bootstrap.sh
+      - name: Configure
+        run: cmake --preset dev
+      - name: Build veloxd
+        run: cmake --build --preset dev --target veloxd
+      - name: Nightly integration run
+        run: python3 tests/integration/nightly_run.py --veloxd build/dev/bin/veloxd --tasks 50 --timeout 180