Nightly `resolc_web.js` broken, all nightly binaries auth-gated

Description

Issues

1. The nightly resolc_web.js bundle cannot fetch resolc.wasm

   • js/emscripten/build.js bakes the wasm URL into the bundle at build time via env RELEASE_RESOLC_WASM_URI:
     https://github.com/paritytech/revive/blob/3a20436ddb9efb30b91af73178a2e8143e4f9491/js/emscripten/build.js#L7-L8
   • The build workflow sets that to …/releases/download/${{ github.ref_name }}/resolc.wasm
   • For tagged releases this resolves correctly. For nightly cron on main it becomes …/releases/download/main/resolc.wasm, which 404s
   • test-wasm.yml doesn't catch this because its bundle uses the localhost-fallback URL baked in instead

2. All nightly binary URLs require GitHub auth

   • They're GitHub Actions artifact URLs (…/actions/runs/<id>/artifacts/<artifact-id>)
   • Anonymous consumers are redirected to a URL that 404s

[!NOTE]
The issues are related:

For the nightly wasm release, the baked URL needs to be a deterministic (issue 1) and publicly-reachable (issue 2) URL.

Current Publish Chain

flowchart TD
    A[reusable-build.yml] -->|"bakes RELEASE_RESOLC_WASM_URI<br/>into resolc_web.js"| B[upload-artifact]
    B -->|"per-run URL<br/>(auth-gated)"| C[release-nightly.yml<br/>generate-nightly-json]
    C -->|"writes URL into<br/>resolc-bin/nightly/&lt;platform&gt;/list.json"| D[Consumer follows URL]
    D -->|Anonymous| E[Download 404s]
    D -->|Authenticated| F[Wasm fetch 404s]

Solution Options

• Upload to anonymously-readable object storage
  • Fixes both bugs: stable, public URLs, predictable at build time
  • We could upload nightly binaries to an anonymously-readable object storage under deterministic paths, e.g.:
    • <bucket-url>/nightly/wasm/<longVersion>/{resolc.wasm, resolc.js, resolc_web.js}
    • <bucket-url>/nightly/linux/<longVersion>/resolc-x86_64-unknown-linux-musl
    • <bucket-url>/nightly/macos/<longVersion>/resolc-universal-apple-darwin
    • <bucket-url>/nightly/windows/<longVersion>/resolc-x86_64-pc-windows-msvc.exe
  • Bake that corresponding URL into resolc_web.js and have resolc-bin's list.json reference the same URLs
  • The bucket's lifecycle policy can automatically handle deleting old binaries
    • E.g. we could choose to always keep only the 7, 14, or 30 etc. most recent nightly builds
  • The nightly JSON generator script would also need to be updated to remove old entries to stay in sync with what is actually in the bucket

Likely Less Ideal

• Rolling nightly GitHub Release tag
  • Would solve both bugs, but would clutter the Releases page
• Host binaries on paritytech/resolc-bin via GitHub Pages
  • Would solve both bugs, but GH Pages has site limits, and committing binaries indefinitely inflates the repo's git history

Start with js/emscripten/build.js and the reusable-build.yml, test-wasm.yml, and release-nightly.yml workflows to trace how nightly URLs are baked and published. Decide on a public, deterministic storage path, then verify that resolc_web.js can fetch resolc.wasm anonymously and that resolc-bin nightly list.json points to downloadable binaries.