fix: isolate nightly release staging

[f-trycua]

Summary

• add a reusable stage-versioned-tree release-control command that copies a registered source tree and rewrites only its declared version sites
• stage the Driver skill pack in an isolated release tree instead of running apply-version against the publish checkout
• restore strict stable-authority validation for manifest creation and nightly tag publication
• make staging transactional: existing destinations, unregistered trees, overlapping paths, and incomplete Cargo trees fail closed
• upgrade the stack's transaction rehearsal to execute the same CLI entry points and argument shapes used by Actions

Root cause

The Driver publish job mutated its source checkout to the nightly version before attribution and publication validation. Those later phases also used the checkout as stable-version authority, which forced exceptions such as require_stable_state=False and caused two initial rollout failures.

Impact

Nightly artifacts are unchanged in shape: the skill tarball still contains the nightly-versioned skill, while installers and verified platform archives retain their existing contracts. The difference is architectural: stable source authority remains immutable throughout publication.

Validation

• uv run --no-project --with pytest --with jsonschema --with pyyaml --with toml pytest .github/scripts/tests/ -q — 218 passed, 18 subtests passed
• python3 .github/scripts/release_channels.py validate — 2 components validated
• go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/nightly-cua-driver.yml .github/workflows/ci-test-scripts.yml
• Ruff check and format validation for all changed Python files
• PyYAML parse of both changed workflows
• git diff --check

Stack

1. #3173 — CI path coverage and full synthetic nightly transaction rehearsal.
2. This PR — isolated versioned staging and restored strict authority validation.

Exclusions

• no schedule, channel-selection, installer-default, stable-release, signing, or notarization changes
• no public nightly is triggered by this PR

Refs #3096

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.