ci: follow main onto the pre-release channel

Main moved CI from nightly to pre-release, which now carries the `process.allow`
policy field this branch needs. The Copilot agent environment and the release
build still installed nightly to match the CI this branch had set; both follow.

The seed pin came back to main's `0.10.10+f8a486b6f` in the rebase, so the
signing list drops `lib/libLLVM.dylib` again — that entry existed because the
nightly archive shipped a 100MB LLVM library the pinned build did not. Checked
against the installed toolchain, which IS that version: the other 37 listed
paths are present and only this one is absent, so it would have named a file
that does not exist.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: tonyfettes

.github/workflows/copilot-setup-steps.yml

@@ -29,12 +29,12 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      # Nightly, to match CI: `run_moonbit`'s policy states its spawn allowlist
-      # with `process.allow`, which stable's moonrun rejects outright, so an
-      # agent working here on stable would find every snippet refused.
+      # Pre-release, to match CI: `run_moonbit`'s policy states its spawn
+      # allowlist with `process.allow`, which stable's moonrun rejects outright,
+      # so an agent working here on stable would find every snippet refused.
       - name: Set up MoonBit
         run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash -s nightly
+          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash -s pre-release
           echo "$HOME/.moon/bin" >> $GITHUB_PATH
 
       - name: Update MoonBit dependencies

.github/workflows/desktop-release.yml

@@ -159,14 +159,14 @@ jobs:
           expected="version = \"$RELEASE_VERSION\""
           grep -Fx "$expected" desktop/moon.mod
 
-      # Nightly, matching CI. This is the toolchain that BUILDS the app, not the
-      # seed it ships (that one is pinned by `desktop/.moonbit-version`), but if
-      # the two channels differed then a change compiling on the channel CI runs
-      # could still break the release build, and nothing would catch it until a
-      # release ran.
+      # Pre-release, matching CI. This is the toolchain that BUILDS the app, not
+      # the seed it ships (that one is pinned by `desktop/.moonbit-version`), but
+      # if the two channels differed then a change compiling on the channel CI
+      # runs could still break the release build, and nothing would catch it
+      # until a release ran.
       - name: Set up MoonBit
         run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash -s nightly
+          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash -s pre-release
           echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
 
       - name: Show MoonBit version

desktop/proton.project.json

@@ -38,7 +38,6 @@
         "target/proton-package-input/toolchains/moonbit/macos-arm64/bin/moonfmt",
         "target/proton-package-input/toolchains/moonbit/macos-arm64/bin/mooninfo",
         "target/proton-package-input/toolchains/moonbit/macos-arm64/bin/moonrun",
-        "target/proton-package-input/toolchains/moonbit/macos-arm64/lib/libLLVM.dylib",
         "target/proton-package-input/toolchains/moonbit/macos-arm64/lib/libbinaryen.dylib",
         "target/proton-package-input/toolchains/moonbit/macos-arm64/lib/why3/commands/why3bench.cmxs",
         "target/proton-package-input/toolchains/moonbit/macos-arm64/lib/why3/commands/why3config.cmxs",