feat: manage nightly release workflow

[vitormattos]

Moves the LibreSign nightly pipeline into the managed workflow catalog and refactors it around the tested release-stable-select Action from v0.6.0.

Highlights:

• publishes only when the current branch is the highest exact stable<N> branch;
• exposes current/latest release-line decisions in logs and the job summary;
• keeps a full build/package/sign/artifact-validation/App-Store publication path;
• aligns third-party Actions with the current App Store workflow pins;
• removes unnecessary actions: write permission and avoids persisted checkout credentials;
• moves the floating nightly tag via the GitHub API;
• adds template acceptance tests and publishes nightly-release through the organization catalog.

This is LibreCode-owned workflow code; no imported Nextcloud workflow is renamed or modified.