#18713 fix(nightly-next): wait for notarization in the job and publish

Summary

Published nightly-next only submitted its DMG to Apple and published nothing (#18618 sets CMUX_NOTARY_SUBMIT_ONLY). Main's auto-resume no longer continues nightly-next (#18711), so nightly-next needs its own path inside nightly.yml.

This is part (1):

• The build job waits for Apple for up to 20m on nightly-next (40m elsewhere, unchanged).
• An Accepted build is stapled and validated, then gets its cmux-next appcast. publish-nightly publishes it on the nightly-next track (release-next environment, nightly-next guard, cmux-nightly-next bucket), as it did before #18618.
• A wait that runs out no longer fails. notarize-nightly-dmg.sh (with CMUX_NOTARY_PENDING_ON_TIMEOUT) records the submission with wait_timed_out=true and outputs submission_pending=true. The existing recovery artifact is uploaded, and syspolicy, the appcast, the variant upload and publish-nightly are skipped (job output notary_pending).

Part (2), where the next nightly-next run polls the previous pending submission and publishes the newer accepted build, follows in a separate PR.

Main and RC are unchanged: they never set pending-on-timeout, so notary_pending stays empty and every gate reduces to the old condition.

Testing

• Red commit 1d6943bffc46, run locally: tests/test_notarize_nightly_dmg.sh fails with "a bounded nightly-next wait that ran out must hand off the submission". tests/test_nightly_universal_build.sh fails on the missing bounded-wait contract. tests/test_nightly_next_notary_handoff.py fails test_timed_out_wait_is_handed_off ("refusing automatic continuation").
• Fix: all three pass locally, along with actionlint on nightly.yml and the other nightly-next guard tests. The new test is wired into ci-guards (release-notary).
• Second commit: the notarize-step timeout bound test now reads the per-track wait (20m nightly-next, 40m main/RC floor kept).
• CI coverage: ci-guards (where these tests live) does not run for feat-cmux-next, on PRs or on pushes, so no CI job executed them. I ran every release-notary guard step locally on head d3739144770563d447b818c8f1721764b3e1d3e6. All pass, except two that need CI-only inputs (RUNNER_TEMP/matrix, the ghostty-next submodule) and tests/test_nightly_cmux_tui_resolve.py, which fails identically on the feat-cmux-next base.
• Not verified: a real notarization through the new path. It runs on the next promoted nightly-next push.

Changelog

none

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

[!NOTE]
Medium Risk
Changes nightly release notarization and publish gating for the nightly-next track; main/RC paths are unchanged but mistakes could block or prematurely publish builds.

Overview
nightly-next no longer uses submit-only notarization (CMUX_NOTARY_SUBMIT_ONLY is dropped from the workflow). The build job waits on Apple (20m on nightly-next, 40m elsewhere), staples and publishes when Accepted, and only defers work when the wait times out.

notarize-nightly-dmg.sh gains CMUX_NOTARY_PENDING_ON_TIMEOUT: a timeout after a successful upload records wait_timed_out=true, sets submission_pending=true, and exits successfully instead of failing the job. The recovery-artifact step treats that case as handoff-worthy (not a failed submit).

nightly.yml exposes job output notary_pending and gates syspolicy, Sparkle appcast, variant upload, and publish-nightly on pending state rather than blanket-skipping the nightly-next track—so Accepted nightly-next builds can publish in the same run again.

CI adds test_nightly_next_notary_handoff.py and extends existing notarization guard tests for the bounded-wait contract.

^{Reviewed by Cursor Bugbot for commit d3739144770563d447b818c8f1721764b3e1d3e6. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Fixes nightly-next publishing by waiting for notarization in the build job and publishing Accepted builds on the nightly-next track. Previously it only submitted the DMG to Apple (#18618 set CMUX_NOTARY_SUBMIT_ONLY), and main's auto-resume no longer continues nightly-next (#18711), so nightly-next needed its own path.

On nightly-next the wait is bounded to 20m (40m on main/RC, unchanged). An Accepted build is stapled, gets its cmux-next appcast, and is published by publish-nightly (release-next environment, nightly-next guard, cmux-nightly-next bucket). If the wait times out, notarize-nightly-dmg.sh records the submission with wait_timed_out=true, outputs submission_pending=true, and uploads the existing recovery artifact; the job no longer fails. Syspolicy, appcast, variant upload, and publish-nightly are skipped for pending submissions. The next nightly-next run will poll the previous pending submission and publish the newer Accepted build (follow-up PR). Main and RC are unchanged.