Ensure Nightly release source archive always matches the workflow commit (#10094)

The Nightly release occasionally exposed a mismatch between the commit
shown on the release page and the downloaded “Source code” archive. Root
cause was non-deterministic `Nightly` tag/release state during publish.

- **Deterministic Nightly tag lifecycle**
- Serialize Nightly workflow runs with a dedicated concurrency group to
prevent overlapping tag/release mutations.
- Replace best-effort cleanup with explicit release-exists checks and
failure-on-cleanup-error behavior.
  - Remove orphan `Nightly` tags even when no release exists.

- **Pin release to the exact workflow commit**
- Force-update `Nightly` to `${{ github.sha }}` and push it before
release creation.
- Verify remote tag SHA (including annotated-tag dereference shape)
matches `${{ github.sha }}`.
- Create release with `--verify-tag` so source archives are generated
from the validated tag, not an implicit/stale target.

- **Workflow behavior change (deploy section)**
  ```yaml
  concurrency:
    group: nightly-release
    cancel-in-progress: false
  ```

  ```bash
  git tag -f Nightly "${{ github.sha }}"
  git push --force origin refs/tags/Nightly
  gh release create Nightly --verify-tag ...
  ```

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

.github/workflows/nightly.yml

@@ -16,6 +16,10 @@ on:
         type: boolean
         default: false
 
+concurrency:
+  group: nightly-release
+  cancel-in-progress: false
+
 permissions:
   contents: write
 
@@ -824,19 +828,44 @@ jobs:
         run: ls -R tmp
       
       - name: Delete existing Nightly release and tag
-        continue-on-error: true
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          # Delete the release first (this also deletes assets)
-          gh release delete Nightly --yes || echo "No release to delete"
-          # Delete the tag explicitly
-          git push origin :refs/tags/Nightly || echo "No tag to delete"
+          if gh release view Nightly > /dev/null 2>&1; then
+            # Delete the release and associated tag if it exists.
+            if ! gh release delete Nightly --yes --cleanup-tag; then
+              echo "Failed to delete existing Nightly release/tag"
+              exit 1
+            fi
+          else
+            echo "No release to delete"
+          fi
+
+          if git ls-remote --exit-code --tags origin refs/tags/Nightly > /dev/null 2>&1; then
+            # Tag may exist without a release (for example, if a previous run failed mid-deploy).
+            git push origin :refs/tags/Nightly
+          fi
       
       - name: Create Nightly release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          git tag -f Nightly "${{ github.sha }}"
+          if ! git push --force origin refs/tags/Nightly; then
+            echo "Failed to push Nightly tag to origin"
+            exit 1
+          fi
+
+          TAG_SHA="$(git ls-remote --tags origin refs/tags/Nightly refs/tags/Nightly^{} | awk '
+            $2 == "refs/tags/Nightly^{}" { sha = $1 }
+            $2 == "refs/tags/Nightly" && sha == "" { sha = $1 }
+            END { print sha }
+          ')"
+          if [ "$TAG_SHA" != "${{ github.sha }}" ]; then
+            echo "Nightly tag points to $TAG_SHA, expected ${{ github.sha }}"
+            exit 1
+          fi
+
           ls
           find tmp -type f \( -name "*.zip" -o -name "*.whl" -o -name "*.tar.gz" -o -name "*.nupkg" -o -name "*.snupkg" \) -print0 > release_files.txt
           
@@ -862,7 +891,7 @@ jobs:
               --title "Nightly" \
               --notes "Automated nightly build from commit ${{ github.sha }}" \
               --prerelease \
-              --target ${{ github.sha }} \
+              --verify-tag \
               "${unique_files[@]}"
           else
             echo "No files to release after deduplication"