ci: the nightly's proofs run last, and cannot hold back the images

Nightly 174 passed acceptance, then Isabelle was killed building HOL-Library
(exit 137, out of memory on the runner), and the images were never built or
published. The proofs check the theories, not the images: they now run after
the publish, whatever happened before them, and a failure still turns the run
red. Their log stays in the run's logs artifact. A release still runs them
before it publishes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

scripts/nightly.sh

@@ -3,7 +3,8 @@
 # images, the documents, and Nexus. One stage per call; the workflows run each as a step
 # (.gitea/workflows/nightly.yml, release.yml, nightly-docs.yml).
 #
-# The images, in this order (any failure ends the run; nothing is published after it):
+# The images, in this order (any failure ends the run; nothing is published after it) -- except
+# that the nightly runs the proofs last, whatever happened before them (nightly.yml says why):
 #
 #   scripts/nightly.sh accept <amd64|aarch64|riscv64|stick-high>
 #       One boot of the acceptance protocol (.claude/CLAUDE.md), in the foreground, one QEMU at a
@@ -27,7 +28,8 @@
 #   scripts/nightly.sh publish <URL>
 #       org.starship:kernelImage:<VERSION> to that Maven repository, in one deploy (one
 #       timestamp): classifier pc (iso), raspi5 and milkv (img.xz), and logs (tar.gz: this
-#       run's serial logs, proof log and DoE CSVs -- the evidence for the rest).
+#       run's serial logs and DoE CSVs -- the evidence for the rest; and the proof log, when the
+#       proofs ran before it, as a release runs them).
 #
 # The documents (a separate pipeline):
 #