ci: real download links on PRs via nightly.link, one artifact per platform

[DTTerastar]

Follow-up to #57. That PR linked the Actions run page, which isn't a download link — you still have to find the right row, and it's useless to anyone not signed in.

Why the obvious fix doesn't work

GitHub does have a per-artifact URL, /actions/runs/<run>/artifacts/<id>. It only works with browser session cookies. With a token it 307s to a /suites/... URL that then 404s:

$ curl -sSL -H "Authorization: token $(gh auth token)" \
    ".../actions/runs/29796831289/artifacts/8482289225"
final_status=404 size=9

So a plain link is one-click only for signed-in humans, and nothing at all for a logged-out visitor. GitHub exposes no anonymous artifact URL.

Change

1. Links via nightly.link — a third-party redirector that resolves an artifact to an anonymous download. Verified against the existing artifact with no credentials of any kind:

$ curl -sSL -o nl.zip "https://nightly.link/quantcli/liftoff-export-cli/suites/80695030218/artifacts/8482289225"
status=200 bytes=13859253
nl.zip: Zip archive data
  6844928  liftoff-export-windows-amd64.exe
  ...5 files

Public repos need no app install. Installing it is still worth doing separately — it stops our downloads sharing nightly.link's global API rate limit — but nothing here depends on it.

2. One artifact per platform instead of one bundle, so each link is a single binary. A Windows user was pulling 33 MB of Linux and macOS binaries to get a 6 MB .exe. The build job becomes a 5-way matrix, which also parallelizes it.

The comment now looks like:

Platform	Download
macOS (Apple silicon)	liftoff-export-darwin-arm64.zip
Windows x86_64	liftoff-export-windows-amd64.zip

Trade-off worth stating plainly

This puts a third-party service in the path of "download and test this PR." nightly.link is open source and widely used, it only ever redirects to GitHub's own storage, and it can't serve anything from a private repo without an explicit app install. But it is someone else's infrastructure, and if it's down the links are down — the run-page link is kept in the footer as a signed-in fallback. If that trade isn't worth it, the alternative is publishing per-PR prerelease tags, which gives genuinely first-party anonymous URLs at the cost of release-list clutter and cleanup on close.

Verification

• Both workflows parse as valid YAML.
• Dry-ran the comment generation against the live API — check-suite resolution, artifact enumeration, label mapping, and URL construction all produce the expected markdown.
• Anonymous nightly.link download confirmed working (above).

Note this PR's own CI comment will still be the old run-page style, since the comment workflow runs from main. The new format starts on the next PR after this merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_013JJnPtEtP97to9Rv2QMoer

[github-actions]

Try this PR without building it

CI cross-compiled review binaries for commit cbda861:

Download from the run page — the liftoff-export artifact holds all platforms.

Platform	File
macOS (Apple silicon)	liftoff-export-darwin-arm64
macOS (Intel)	liftoff-export-darwin-amd64
Linux x86_64	liftoff-export-linux-amd64
Linux arm64	liftoff-export-linux-arm64
Windows x86_64	liftoff-export-windows-amd64.exe

On macOS and Linux, unzip then chmod +x liftoff-export-* before running. macOS Gatekeeper will block the unsigned binary on first run — right-click → Open, or xattr -d com.apple.quarantine <file>.

Downloading requires being signed in to GitHub, and artifacts expire 14 days after the run.

_{Posted automatically. Updated on each push to this PR.}