Run the release signing preflight every Monday (#2568)

## Why

The nightly release rehearsal dispatched `release-signing-preflight.yml`
until it was switched off with the release steward on 4 October 2026, so
nothing now runs it before a release. A lapsed Apple developer
agreement, a revoked notary key or an expiring Developer ID certificate
would first show up as a failed release candidate. That is what happened
to v6.4.6-rc.1 on 2 October.

## What changes

- A `schedule` trigger runs the preflight every Monday at 06:23 UTC.
Manual dispatch from `main` still works.
- The certificate check already fails 30 days before expiry, so a weekly
run leaves weeks to renew.
- A scheduled failure opens an issue titled "Release signing preflight
is failing", or comments on the open one, and the next passing scheduled
run closes it. GitHub's own email only reaches whoever last edited the
cron line. The issue links to the run and contains no credential
details.
- The workflow comment and `.github/workflows/README.md` describe both.

The preflight signs only a throwaway probe binary. It builds, notarizes,
uploads and publishes nothing. `scripts/check_workflow_trust.py` passes.

.github/workflows/README.md

@@ -154,10 +154,10 @@ nothing; results are in the job log and step summary. Run
 it locally (`PULSE_REHEARSAL_ENGINE=podman` on hosts without Docker).
 
 `release-signing-preflight.yml` checks that the macOS release signing path
-would work, without building or publishing anything. It runs on manual
-dispatch from `main`; the nightly release rehearsal that used to dispatch it
-was switched off with the release steward on 4 October 2026. On a `macos-15`
-runner it imports
+would work, without building or publishing anything. It runs every Monday at
+06:23 UTC and on manual dispatch from `main`. The schedule replaces the nightly
+release rehearsal that dispatched it until that rehearsal was switched off with
+the release steward on 4 October 2026. On a `macos-15` runner it imports
 the Developer ID certificate into a throwaway keychain, requires the configured
 identity to be valid for code signing and at least 30 days from expiry, signs
 and verifies a probe binary with a secure timestamp, and reads the Apple notary

.github/workflows/release-signing-preflight.yml

@@ -3,16 +3,20 @@ name: Release Signing Preflight
 # the dispatch answer is lost.
 run-name: ${{ format('Release signing preflight (no release build or publication){0}', inputs.request_id && format(' [{0}]', inputs.request_id) || '') }}
 
-# Dispatch this from main to find a lapsed Apple developer agreement, a revoked
-# notary key or an expiring Developer ID certificate before a release candidate
-# fails on it. The maintainer's nightly release rehearsal (pulse-dev-infra
+# This finds a lapsed Apple developer agreement, a revoked notary key or an
+# expiring Developer ID certificate before a release candidate fails on it. It
+# runs every Monday and can be dispatched from main at any time. The
+# maintainer's nightly release rehearsal (pulse-dev-infra
 # pulse-maintainer-release-rehearsal) dispatched it until that rehearsal was
-# switched off with the release steward on 4 October 2026.
+# switched off with the release steward on 4 October 2026. The weekly schedule
+# replaces it, and the certificate check's 30-day margin leaves weeks to renew.
 # On 2 Oct 2026 v6.4.6-rc.1 failed notarization because the agreement was
 # unsigned. This signs only a throwaway probe binary on the runner; it builds,
 # notarizes, uploads and publishes nothing. The certificate and notary checks
 # are independent, so one run names every broken credential.
 on:
+  schedule:
+    - cron: '23 6 * * 1'
   workflow_dispatch:
     inputs:
       request_id: