chore(ci): add the nightly scheduled tier and watch Cloudflare ranges

[FSM1]

What changes

One nightly.yml now owns every scheduled slot. scheduled-liveness.yml is renamed into it, so the repository keeps one cron surface instead of three.

• API Long-Horizon Liveness — unchanged, carried over by the rename.
• Full-Matrix Flake Surveillance — calls ci-e2e.yml through a new workflow_call trigger instead of restating its suites, so the nightly run reports the same job names the main gate does. A force-all input stands in for the push change filter, which has no base commit on a night with no push. retries: 0 needs no new setting: tests/web-e2e/playwright.config.ts already sets it as policy in both slices.
• Cloudflare Range Watch — diffs the committed trusted-proxy snapshot against https://api.cloudflare.com/client/v4/ips and fails on any difference. CLOUDFLARE_RANGES moves into scripts/cloudflare-ranges.mjs, because importing the accelerator front check would run Docker; the Lint gate still pins docker/Caddyfile to the same set and the Caddy runtime is unchanged.
• Report — one job with issues: write runs when any slot fails and opens, or comments on, a single comp:ci tracking issue. One issue is reused, so a week of red nights does not file seven issues.

blueprint/deploy.md and blueprint/testing.md record the tier, and the range list moves from a residual assumption to a watched one.

Closes #1385.
Closes #652.
Closes #1508.

Verification

• zizmor 1.25.2 --no-online-audits .github/workflows/ .github/actions/ — no findings.
• actionlint on both edited workflows — clean.
• pnpm lint, pnpm lint:md, pnpm lint:tracker-refs — clean.
• pnpm lint:accelerator-front against the real adapted Caddy config — obligations hold, so the extracted constant feeds the same gate.
• node scripts/check-cloudflare-ranges.mjs — the committed 22 ranges match Cloudflare's live list today. The unreachable-source path was exercised against an unresolvable host and exits 1 with a readable message.
• pnpm --filter @cipherbox/api typecheck — clean.

GitHub reads schedule and workflow_dispatch from the default branch alone, so the new file is inert on this branch and becomes dispatchable only after the merge. The first real exercise of the nightly tier is therefore the night after this lands.

Body checks and follow-ups filed

• ci: add the nightly full-matrix flake surveillance run #1385 — appended a dated body check recording the workflow_call plus force-all decision, the retries: 0 finding, the notification shape, and the default-branch limit.
• ci: add the nightly scheduled tier #652 — appended a dated body check: slot 1 already shipped as scheduled-liveness.yml, so the residual scope is the rename plus ci: add the nightly full-matrix flake surveillance run #1385 and deploy: notice when Cloudflare changes its published IP ranges #1508. The parent closes with them.
• deploy: notice when Cloudflare changes its published IP ranges #1508 — appended a dated body check: the departed-range direction is closed by the per-zone origin-pull mTLS gate, so the remaining direction is availability plus the daily diff. The implemented shape is recorded.
• No new issue filed. No finding in this lane needed one.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}