ci: harden docker/release/nightly GitHub Actions workflows

- buildx: adopt docker/metadata-action for image tags (replaces hand-rolled shell), add gha build cache, concurrency control, explicit checkout, and least-privilege permissions

- release: add explicit permissions and concurrency (no cancel-in-flight); drop dead UPX install step (disabled in .goreleaser.yaml, see #863)

- trigger-nightly: add concurrency, replace archived dev-drprasad/delete-older-releases with native gh, and harden the 24h commit check

.github/workflows/release.yml

@@ -8,8 +8,11 @@ on:
 
 permissions:
   contents: write
-  # packages: write
-  # issues: write
+
+# Never cancel an in-flight release; only de-dupe a re-pushed tag.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   goreleaser:
@@ -23,12 +26,7 @@ jobs:
         with:
           go-version: '1.26'
           cache: true
-      - name: Install UPX
-        uses: crazy-max/ghaction-upx@v3
-        with:
-          install-only: true
-      # More assembly might be required: Docker logins, GPG, etc. It all depends
-      # on your needs.
+      # UPX is disabled in .goreleaser.yaml (see #863); the install step was removed.
       - uses: goreleaser/goreleaser-action@v6
         with:
           # either 'goreleaser' (default) or 'goreleaser-pro':