Pin nightly artifact actions to immutable commit SHAs

[coderabbitai]

Summary

Pin the artifact actions in the nightly workflow to approved immutable commit SHAs.

Rationale

.github/workflows/nightly.yml currently references version tags for actions/download-artifact@v8 and actions/upload-artifact@v7. Immutable SHA pinning satisfies the repository's action-pinning security policy and prevents a mutable tag from changing the executed action revision.

Affected area

• .github/workflows/nightly.yml
  • All actions/download-artifact usages
  • All actions/upload-artifact usages

Required changes

Replace each tag-based reference for these artifact actions with the approved immutable commit SHA corresponding to its current version. Preserve all existing inputs and workflow behavior.

Acceptance criteria

• No actions/download-artifact or actions/upload-artifact reference in .github/workflows/nightly.yml is tag-pinned.
• Each replacement SHA is the approved immutable revision for the intended action version.
• Existing action configuration and workflow behavior remain unchanged.
• The workflow passes the repository's action-pinning/security validation.

Backlinks

• Deferred from PR [infra] Preserve nightly artifacts across reruns #57: [infra] Preserve nightly artifacts across reruns #57
• Originating review comment: [infra] Preserve nightly artifacts across reruns #57 (comment)
• Requested by: @vikuznetsov-nvidia