#18618 fix(nightly-next): hand off notarization state

Changelog

• Fixed nightly-next to hand the exact signed DMG to Apple asynchronously while retaining submission state and evidence.

What changed

Nightly-next now uses the shared notarization helper in submit-only mode. The helper captures notarytool JSON from both output streams, preserves the submission ID and DMG SHA in sidecars, and never staples or publishes before a later Accepted continuation. The fast arm64 path keeps Developer ID signing and smoke coverage while skipping helper and outer notarization.

A nightly-next pending handoff uploads the exact DMG, app archive, state, and notary log. Normal nightly and RC paths keep their bounded wait and publication behavior.

The existing main recovery resolver is intentionally outside this PR. It currently accepts the main nightly DMG identity and three variants, while nightly-next emits its own prefix and arm64 only. This PR therefore preserves evidence and the no-publish boundary without modifying the owner recovery workflow.

Validation

• actionlint .github/workflows/nightly.yml
• bash tests/test_notarize_nightly_dmg.sh
• bash tests/test_nightly_universal_build.sh
• bash -n scripts/ci/notarize-nightly-dmg.sh tests/test_notarize_nightly_dmg.sh tests/test_nightly_universal_build.sh
• git diff --check

No native build was run locally. The repository-wide verifier still reports existing localization parity/default mismatches and stale workspace package grouping, outside these four files.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

[!NOTE]
High Risk
Changes Apple notarization and nightly-next release boundaries; mis-handoff could block publishes or ship before Accepted, though submit-only mode is designed to fail closed.

Overview
nightly-next published builds now submit the signed DMG to Apple without waiting (CMUX_NOTARY_SUBMIT_ONLY), persist submission id/SHA in .notarization.state and logs, and exit before stapling or publishing. On pending or failed notary, the workflow packages and uploads a recovery artifact (DMG, app tarball, state, log, cmux-nightly-notarization-recovery.json).

notarize-nightly-dmg.sh adds CMUX_SKIP_NOTARIZATION for fast dogfood DMGs (signed DMG only), captures stdout+stderr so timeouts still record the submission id, and sets submission_pending=true for submit-only handoffs. Main/RC keep the bounded --wait path.

The nightly-next track no longer runs in-job syspolicy_check, Sparkle appcasts, variant uploads, or publish-nightly from the sign job; fast arm64 uploads no longer require notary_paused != true. Tests lock in the new workflow contract.

^{Reviewed by Cursor Bugbot for commit 1bdd2e0e9dfbc5a2dbf9cd03b61e50f851b6b71a. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Hands Apple notarization of nightly-next DMGs to a later continuation run that verifies receipt before stapling or publishing.

• nightly-next now submits the signed DMG asynchronously and uploads the exact DMG, app archive, submission state, and notary log as recovery artifacts.
• Stapling, appcasts, syspolicy checks, and publication are deferred until a later run sees an Accepted status from Apple.
• Fast arm64 dogfood builds keep Developer ID signing but skip Apple notarization entirely.
• Normal nightly and RC builds keep their existing bounded wait and publication behavior.
• Adds fixture-backed tests for the submit-only handoff and recovery artifact validation.