Update 2 and solution:
In my opinion there is some serious bug in Nexus. But it works. What you need to do is to use a classic HTTP Username authentication, as username you GH username, and as password - personal token. Now you must uncheck checkbox “Validate that all content uploaded to this repository is of a MIME type appropriate for the repository format”… Which is stupid.
It will NOT work with “Preemptive Bearer Token”.
Sonatype, please fix this…