chore(ci): run the lock bump daily instead of weekly

Move bump.yml's schedule from Mondays to every day (temporarily 17:39
UTC to trigger a run shortly). Sync the ROADMAP cadence note + shipped
log to match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/bump.yml

@@ -1,11 +1,12 @@
 # Nomarchy scheduled lock bump — the automated half of "rock-stable
-# without rotting": once a week, update flake.lock (inputs track pinned
+# without rotting": once a day, update flake.lock (inputs track pinned
 # release branches, so this never jumps a NixOS release — that's a
 # deliberate hand-edited v2, see agent/GOALS.md), gate it, and land it
 # on main only on green. `v1` promotion stays human, always.
 #
 # Fast lane: workflow_dispatch. For a security fix upstream, run this
-# workflow manually from the Actions tab instead of waiting for Monday.
+# workflow manually from the Actions tab instead of waiting for the
+# next daily run.
 #
 # Gate scope: `nix flake check --no-build` (eval tier) followed by a V1 build
 # (home-manager activation package + nixos toplevel) to catch compilation errors.
@@ -18,7 +19,7 @@
 #
 # Failure mode: a red gate fails this run visibly and pushes nothing;
 # next schedule retries. A push race (someone landed on main mid-run)
-# also just fails the final push — rerun or wait a week.
+# also just fails the final push — rerun or wait a day.
 #
 # Container recipe (nixbld users, sandbox=false, pinned Nix, plain-shell
 # install) inherited from check.yml — the gotchas are documented there.
@@ -27,7 +28,7 @@ name: Lock bump
 
 on:
   schedule:
-    - cron: '17 5 * * 1'   # Mondays 05:17 UTC
+    - cron: '39 17 * * *'   # daily 17:39 UTC
   workflow_dispatch:
 
 jobs:

docs/ROADMAP.md

@@ -1840,8 +1840,9 @@ Design/decision records and a running log of shipped work (items marked
   builds `system.build.toplevel`, and on green lands on `main` — which nobody
   tracks, so a bad bump costs a debug session, not a user outage; `v1` stays
   the manual on-hardware gate (it only ever fast-forwards, never force-pushed,
-  or a user's locked rev can vanish from history). **Cadence weekly**
-  (release-26.05 doesn't move fast; nightly is just churn), and `nix flake
+  or a user's locked rev can vanish from history). **Cadence daily**
+  (2026-07-20; was weekly — release-26.05 doesn't move fast, but daily
+  shrinks security-patch latency and a no-op bump is cheap), and `nix flake
   update` stays *within* the pinned release branches — no surprise major bump
   (a 26.11 jump is a deliberate `v2`, hand-edited in flake.nix). Side benefit:
   shrinks the security-patch latency the single-input model otherwise imposes
@@ -1849,8 +1850,9 @@ Design/decision records and a running log of shipped work (items marked
   already eval/build/VM-tested and one hardware promotion away from `v1` —
   worth fast-laning lock-only/security bumps ahead of feature batches.
   **Shipped since:** `.gitea/workflows/check.yml` (eval tier on every main
-  push) and `bump.yml` (Monday 05:17 UTC scheduled lock bump, eval + V1
-  build gate, auto-lands on green — first landing 8fded63, 2026-07-06).
+  push) and `bump.yml` (daily 17:39 UTC scheduled lock bump, eval + V1
+  build gate, auto-lands on green — first landing 8fded63, 2026-07-06;
+  cadence weekly→daily 2026-07-20).
   2026-07-12: both gates moved from one big `nix flake check --no-build`
   (~6.0 GB peak RSS — OOM'd the 4 GB VPS, then could never fit the
   runner's 2 GB container cap) to `tools/ci-eval.sh`, one output per nix