fix: nightly resolution to select newest published release (#562)

* fix(nightly): pick latest nightly by published_at

GitHub's /releases endpoint is not reliably ordered by published_at,
so resolveNightly could pick an older nightly than the most recent
one. Filter, sort by published_at desc, and take the first.

* test(nightly): add regression coverage for release ordering

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

src/github.ts

@@ -28,6 +28,7 @@ const withRetry = async <T>(operation: () => Promise<T>): Promise<T> => {
 
 export interface GitHubRelease {
   tag_name: string;
+  published_at?: string;
 }
 
 // Matches the new-style nightly release tag pattern: vX.Y.Z-<sha>-nightly
@@ -37,6 +38,13 @@ export const isNightlyTag = (tag: string): boolean => {
   return nightlyTagRegex.test(tag);
 };
 
+export const latestNightlyRelease = (releases: Array<GitHubRelease>): GitHubRelease | undefined => {
+  return releases
+    .filter(r => nightlyTagRegex.test(r.tag_name))
+    .sort((a, b) => (b.published_at || '').localeCompare(a.published_at || ''))
+    .shift();
+};
+
 export const getRelease = async (distribution: string, version: string): Promise<GitHubRelease> => {
   if (version === 'latest') {
     core.warning("You are using 'latest' as default version. Will lock to '~> v2'.");
@@ -113,7 +121,7 @@ const resolveNightly = async (distribution: string): Promise<GitHubRelease> => {
     return <Array<GitHubRelease>>JSON.parse(body);
   });
 
-  const match = releases.find(r => nightlyTagRegex.test(r.tag_name));
+  const match = latestNightlyRelease(releases);
   if (!match) {
     throw new Error(`No '<version>-<sha>-nightly' release found in ${url}`);
   }