ci: wait for nightly builds before publishing the release (#2695)

GITHUB_TOKEN-dispatched builds do not trigger downstream workflow_run
jobs. The nightly release check ran before builds finished and then
exited successfully without publishing anything.

Track dispatch run IDs and wait for all missing components to succeed.
Retry failed jobs once, account for delayed rerun state, and fail on
terminal errors. Bound the build and wait job to three hours.

Pass the built commit to publication so later main commits do not
change the release target. Retain component deduplication and manual
build completion handlers, and document the nightly lifecycle.

Add regression coverage for pending builds, retries, terminal failures,
dispatch races, and main advancing before publication. All 34 Node tests
and actionlint for the three nightly workflows pass.

.github/scripts/nightly-release.js

@@ -32,10 +32,10 @@ function releaseNotes(repository, baseline, sha, commits, runs) {
   ].join('\n');
 }
 
-async function prepare({ github, context, core }) {
+async function prepare({ github, context, core, sha }) {
   const repository = context.repo;
   const { data: branch } = await github.rest.repos.getBranch({ ...repository, branch: 'main' });
-  const sha = context.payload.workflow_run?.head_sha || branch.commit.sha;
+  sha ||= context.payload.workflow_run?.head_sha || branch.commit.sha;
   const { data: ancestry } = await github.rest.repos.compareCommitsWithBasehead({
     ...repository, basehead: `${sha}...${branch.commit.sha}`, per_page: 1,
   });