fix(upgrade): check GHCR for nightly version existence instead of GitHub Releases

Fixes CLI-B5

When a user pins a specific nightly version (e.g. `sentry cli upgrade
0.14.0-dev.1772661724`), the `versionExists()` function was checking
GitHub Releases (which only has stable releases). Nightly builds are
published to GHCR with tags like `nightly-0.14.0-dev.1772661724`.

The fix routes nightly version checks to GHCR via `fetchManifest()`
instead of GitHub Releases, so pinned nightly upgrades no longer fail
with a false "Version X not found" error.

Author: BYK

src/lib/upgrade.ts

@@ -31,6 +31,7 @@ import { attemptDeltaUpgrade, type DeltaResult } from "./delta-upgrade.js";
 import { AbortError, UpgradeError } from "./errors.js";
 import {
   downloadNightlyBlob,
+  fetchManifest,
   fetchNightlyManifest,
   findLayerByFilename,
   getAnonymousToken,
@@ -384,9 +385,31 @@ export function fetchLatestVersion(
     : fetchLatestFromNpm();
 }
 
+/**
+ * Check if a versioned nightly tag exists in GHCR.
+ *
+ * Nightly builds are published to GHCR with tags like `nightly-0.14.0-dev.1772661724`.
+ * This performs an anonymous token exchange + manifest HEAD check (2 HTTP requests).
+ *
+ * @param version - Nightly version string (e.g., "0.14.0-dev.1772661724")
+ * @returns true if the nightly tag exists in GHCR
+ */
+async function nightlyVersionExists(version: string): Promise<boolean> {
+  try {
+    const token = await getAnonymousToken();
+    await fetchManifest(token, `nightly-${version}`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Check if a specific version exists in the appropriate registry.
- * curl installations check GitHub releases; package managers check npm.
+ *
+ * Nightly versions are checked against GHCR (where they are published as
+ * versioned tags like `nightly-0.14.0-dev.1772661724`). Stable versions
+ * are checked against GitHub Releases (curl/brew) or npm (package managers).
  *
  * @param method - How the CLI was installed
  * @param version - Version to check (without 'v' prefix)
@@ -397,6 +420,11 @@ export async function versionExists(
   method: InstallationMethod,
   version: string
 ): Promise<boolean> {
+  // Nightly versions are published to GHCR, not GitHub Releases or npm
+  if (isNightlyVersion(version)) {
+    return nightlyVersionExists(version);
+  }
+
   if (method === "curl" || method === "brew") {
     const response = await fetchWithUpgradeError(
       `${GITHUB_RELEASES_URL}/tags/${version}`,