ci(nightly-testing): replace github-script JS with bash - #940

… reasons

Narrowing the toolchain warning to `steps.bump_version.outcome == 'failure'`
left every other step in the job (app token, checkout, tag update, Zulip status
post, branch check, PR creation setup) with no notification at all. Add a final
catch-all step that posts a generic warning with a link to the run whenever the
job fails or is cancelled and neither of the two dedicated warnings fired.

Both `latest_bump_branch` and `bump_version` can fail for several reasons, but
their warnings named a single cause. Record a `reason` output at each failure
point in the scripts and include it in the warning, and reword the step names
and messages so they no longer claim more than the script actually determined.

The three steps that look for the bump branches and read the bump branch
toolchain used the GitHub API from inline JavaScript. The job already
checks out the repository with full depth, so the same information is
available from the local remote-tracking refs. Replace the JavaScript
with short bash steps that use git show-ref, git for-each-ref and git
show. The step ids and output names are unchanged, so the steps that
consume them are untouched.

The retry loop is dropped since nothing hits the network anymore, and
these steps no longer need the API token. The inline JavaScript was also
the only inline code in the workflow that no linter covered, since
actionlint already runs shellcheck over run steps.

Split the pipeline and grouped echoes in the two bash steps into
separate commands, so that a failed branch listing, a missing bump
branch, an unreadable or empty lean-toolchain, and a toolchain that
doesn't match the nightly pattern each record their own reason for the
Zulip warnings, as the github-script versions did.

git for-each-ref can filter, version-sort and limit the bump branches
itself, which replaces the grep/sort/tail chain with a single command.
Also drop the fail() helper and the separate empty-file check: an empty
lean-toolchain now fails the pattern check, and the warning still shows
its content as "(empty)".