Add a (daily?) job against development versions of dependencies

+1 for this. We already have a scheduled nightly CI run but it's sort of pointless; we should make that the "canary" job which tests against the dev versions of all dependencies.

I think this is probably ready for review. I added support for a CANARY=1 environment variable, which will remove the stability constraints and, although not explicitly requiring dev heads of everything, seems to cause Composer to behave the way we want: https://git.drupalcode.org/project/drupal_cms/-/jobs/3850212#L628

I've already adjusted our scheduled nightly build to set CANARY=1, so this should take effect as soon as we merge this MR.

For what it's worth, I agree that this is critical, and should indeed be release-blocking. Once we do a general release, the possibility of contrib breaking us becomes very real and having a canary job in place beforehand will be very valuable.

I think that a general CANARY=1 -- i.e., "just test against the dev branch of everything" -- is a good start here.

In follow-up issues, we could find ways to narrow the scope of these tests. For example, maybe we could do something like this to bring in, say, dev heads of core and the AI module, and only those two:

CANARY='drupal/core,drupal/ai'
# or
CANARY='{"drupal/core":"11.x-dev","drupal/ai":"1.0.x-dev"}'

Since we dynamically generate composer.json, we have a good amount of flexibility here. But I think that casting a wide net initially will get us to where we need to be for our general release.

Oh I missed #8 in the comment above, but would probably go for MINIMUM_STABILITY and then add CANARY_MODULES or something later if necessary.

Thanks for raising this and reviewing it @catch. Definitely needed. Merged into 1.x.