nightly: bundle the unified Wine engine into the app so nightlies install like a release

[realmaitreal]

Part of #103 (nightly release automation).

Makes a nightly build behave like an official release: the unified Wine engine
ships inside Contents/Resources, so opening a nightly installs/updates the
engine offline exactly as an official DMG does, instead of building or
downloading Wine. Installing is a wholesale replace — installer.sh already
does rm -rf deps/wine-unified before extracting.

Until now nothing in the repo put those payloads into Resources; official
DMGs were assembled by hand.

How it works

1. nightly.yml downloads the newest engine release from the private engine
   repo and drops it in payload/wine-unified-bundle.tar.xz.
2. buildapp.sh copies everything in $MNC_PAYLOAD_DIR (default payload/)
   into Resources, so the payload set can grow without touching the script.
3. installer.sh now accepts a .tar.xz bundle as well as the historical
   .zip, and uses the mnc-d3d pack the bundle already carries.

Notes on a few choices

• Release picked by asset name, not --latest. Engine builds are often
  prereleases and the engine repo also publishes d3d-pack-only releases, so
  --latest selects the wrong one.
• --strip-components=1 on extract. The tarball wraps everything in a
  single wine-unified/ dir, but that dir is the destination, so a plain
  extract would nest it twice.
• A missing WINE_ENGINE_TOKEN is not fatal. It warns and builds
  launcher-only, so a fork without the secret still gets a usable nightly. An
  incomplete engine bundle does fail hard: a d3d pack missing either half of
  the D3DMetal runtime loads fine and then dies on Failed to dlopen D3DMetal
  with no hint a file is missing.
• Explicit DMG size check. A bundled nightly lands near GitHub's 2 GB asset
  limit; uploads past it are rejected late and confusingly, so this fails early
  and says so.

Setup required before this can run

A repository secret WINE_ENGINE_TOKEN — a fine-grained PAT, resource owner
mont127, scoped to MacNdCheese-WineEngine-PRIVATE, permission
Contents: read-only (the engine repo is private, so the workflow's own
GITHUB_TOKEN cannot read it).

Verified

Extraction, bundle-completeness checks and the release-selection logic were run
against the real engine asset: --strip-components=1 yields dlls/ loader/ mnc-d3d/ server/… at the destination root, all required paths resolve, and
installer.sh correctly skips re-staging the d3d pack.

Not yet exercised end-to-end in Actions — that needs the secret to exist.