#32513 ci(nightly): get nightly.yml back under its size cap (base red)

Base red: tests/test_workflow_file_size.py fails on feat-cmux-next. Three merged PRs, #32490, #32501 and #32498, together took nightly.yml to 493,218 bytes, past its 490,000-byte cap.

This PR moves two inline run: | blocks into scripts/ci/nightly-steps/, as earlier steps were moved:

• "Build and sign the release notes" becomes release-notes-build-sign.sh. It already ran set -euo pipefail.
• "Embed channel provisioning profile" becomes embed-provisioning-profile.sh, called with bash -e, the same flag GitHub's default shell gave the inline block.

Both jobs already call ./scripts/... in the step just before, so the files are there. Env, conditions and secrets are unchanged.

nightly.yml goes from 493,218 to 485,819 bytes. Expanded by tests/nightly_workflow_text.py, the workflow is identical to base, so every test that reads it sees the same steps.

Tests: test_workflow_file_size (red on base, green here), test_nightly_step_coverage, test_nightly_signer_jobs, test_nightly_workflow_size, test_nightly_trusted_routing, tests/test_nightly_next_identity.py (8/8), tests/test_ci_self_hosted_guard.sh.

Base-red-job: test_workflow_file_size (nightly.yml over its 490,000-byte cap)

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Brings nightly.yml back under its 490,000-byte size cap by moving two inline run: blocks into scripts/ci/nightly-steps/ scripts; the workflow's behavior is unchanged.