Batch stable releases nightly

[bigboateng]

Summary

• check for verified stable releases nightly at 02:00 UTC and on manual request
• require the exact current main commit to have successful push CI before tagging
• skip empty releases and fail closed on source, note, or tag drift
• preserve the existing manual release-candidate path

Verification

• python3 -m unittest discover -s .github/tests -p 'test_*.py'\n- python3 .github/scripts/run_go_tests.py\n- go -C boatstack vet ./...\n- go -C boatstack build ./...\n- workflow YAML parse\n- release-note validation\n- git diff --check

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

Codex automated review

Verdict: patch is correct
Confidence: 0.91

No actionable defect was established. The workflow binds release selection to an exact main commit with successful CI, rechecks main and tag state before publication, and fails closed on rewritten notes or conflicting tags. Model-level verification is not recommended before merge.