fix(ci): Orthrus nightly image is labeled with github.sha instead of the checked-out nightly commit #1867

What: On scheduled runs, github.sha is the head of the default branch (main), not the nightly commit that is checked out (nightly-build.yml:209), so values derived from it point at the wrong commit.

Where: .github/workflows/nightly-build.yml:542 (Orthrus build). The main Charon nightly build has the same pattern at :275-276 and is fixed by the semver build-metadata work (docs/plans/current_spec.md, F7).

Severity: low-medium

Suggested approach: Use the sha of the checked-out commit (git rev-parse HEAD after checkout) for the Orthrus version/VCS_REF as well.