NIT-S01: Run the real e2e nightly and fail on any skip #185

Severity: Medium (TestSkeletonE2E skips unless ASSENT_E2E_GITLAB is set; nothing schedules task e2e, Taskfile.yml:269-280) · Epic: NIT · Landing order: 19 of 21 · Blocked by: #171, E7-S07, P4-E1-S10

Add .github/workflows/nightly-e2e.yaml (cron daily + dispatch, own workflow): boot the GitLab CE container, task build (e2e drives bin/assent), provision an API token on the fresh container (check E7-S07 first; else add hack/ci/e2e-gitlab-token.sh), run e2e with -v, upload logs on failure. A guard parses output: === RUN for the E7-S07/P4-E1-S10 named tests, >= 1 --- PASS, zero --- SKIP. contents: read; continue-on-error/|| true red. The scenarios themselves belong to E7-S07/P4-E1-S10.

Spec: openspec/specs/p5-nit-nightly-integration/spec.md — NIT-S01, REQs REQ-NIT-S01-01, REQ-NIT-S01-02, REQ-NIT-S01-03, REQ-NIT-S01-04; proposed in #166. Gate-wiring rule: openspec/specs/README.md (every new guard, every mode, runs on pull_request in verify).

Operator steps:

• Provide a runner able to boot the GitLab CE container.

Acceptance (one PR; TDD — failing test first):

• REQ-NIT-S01-01 — workflow wiring: scheduled, build, token, verbose run, pinned actions, timeout-minutes — bash hack/lint/nightly_wiring_test.sh
• REQ-NIT-S01-02 (adversarial) — guard rejects --- SKIP or zero === RUN, accepts a clean run — bash hack/ci/e2e_ran_test.sh --self-test
• REQ-NIT-S01-03 (adversarial) — weakening the nightly reds the wiring guard — bash hack/lint/nightly_wiring_test.sh --self-test
• REQ-NIT-S01-04 (post-merge) — one real nightly run executes the named tests with zero skips — gh run view -R PlatformRelay/assent --log | rg -c '^--- PASS'

Done when: every REQ's Verify passes on the PR (or is post-merge with its follow-up issue linked), task check is green, and the gate-wiring rule holds.

Source: spec/oss-quality-signals @ 94be853 (independent review + cold adversarial review, 2026-10-05).