[nightly-security] Handle release candidate appcast watch

[r3dbars]

Summary

• classify one-patch unreleased Info.plist bumps as appcast watch items instead of release-integrity failures
• keep real appcast mismatches as deterministic findings
• document the release-candidate watch behavior

Verification

• python3 -m py_compile scripts/ops/nightly-security-check.py
• python3 scripts/ops/nightly-security-check.py --write-report build/nightly-security-report.json
• bash run-tests.sh
• bash scripts/release/verify-sparkle-release.sh 1.1.32

Nightly result

• Score: 100/100
• Findings: none
• Watch item: Info.plist is prepared for 1.1.33 while appcast remains on published 1.1.32
• No build/Transcripted.app was present, so app-bundle verification was skipped