[vitormattos]

Problem

Release preparation on stable33 fails at the immutable pipeline-pin verification step. The stable branches already use the pinned release-tool build-inspect action, but the trusted main nightly workflow was still based on the older organization template.

Change

• Synchronize only the main nightly-release.yml from the current LibreCodeCoop/.github workflow catalog using the canonical sync script, preserving the repository-specific signing patch.
• Update the corresponding actions-lock.txt entry and catalog provenance.
• Do not relax the release-tool pipeline checks or touch supported stable branches.

Verification

• Canonical workflow sync: changed=true initially and changed=false on second run (idempotent).
• YAML parsed; stable-selection, build inspection, package signing and artifact validation retained.
• Reproduced the same release-tool v0.11.21 pipeline-pin validation locally against stable33, stable34 and stable35: all pass.
• Signed commit, DCO, and git diff --check verified.

Unblocks the existing stable33 release preparation workflow. No release publication is included.