Replace archived marvinpinto/action-automatic-releases in nightly build

Follow-up from #311 (pinning third-party GitHub Actions to commit SHAs).

## Background

The nightly build workflow uses `marvinpinto/action-automatic-releases`, which is now archived and unmaintained upstream (last activity April 2024). #311 pinned it to a commit SHA, which addresses the immediate concern of mutable refs. However, an archived action will not receive future updates, and the pin is labelled `# latest` rather than a semver tag.

## Why this matters

- No upstream maintenance means no future fixes or compatibility updates.
- Dependabot cannot track or propose updates for a pin commented `# latest` (the comment is not a parseable version), so the new `.github/dependabot.yml` config will never raise a PR for this action.

## Proposed change

Replace the action in `.github/workflows/nightly-build.yml` with a maintained alternative, for example:

- `softprops/action-gh-release` (actively maintained), or
- a `gh release create` CLI step using the built-in GitHub CLI.

Whichever is chosen, pin it to a commit SHA with a real semver comment so Dependabot can track it.

## Acceptance criteria

- [ ] Nightly build no longer depends on an archived action.
- [ ] The replacement is pinned to a commit SHA with a semver comment.
- [ ] Nightly release behaviour (tag, draft/prerelease flags, asset upload) is preserved.

Start with .github/workflows/nightly-build.yml and inspect how the archived release action is configured, including its tag, draft/prerelease flags, and asset upload. Compare the proposed maintained action or GitHub CLI approach, then pin the chosen replacement to a commit SHA with a semver comment. Done means the workflow no longer uses the archived action and preserves nightly release behavior.

Written by the indexing model from the issue text.