#18736 fix(nightly-next): wait up to 40m for notarization in the job

Summary

Three nightly-next builds in a row outlasted the 20m in-job notarization wait from #18713: 6d443005's, plus runs 37871970302 and 37872060374, so none published in-job. Published nightly-next now waits up to 40m, the same as main and RC. CMUX_NOTARY_WAIT_TIMEOUT becomes a plain 40m on every track.

The step's 50m and the job's 80m timeouts already cover a 40m wait (tests/test_notarize_nightly_dmg.sh checks the bounds). A wait that still runs out hands off through the recovery artifact as before, and #18722 continues it on a later run.

Testing

• Red commit aac7acb959cc: tests/test_nightly_universal_build.sh fails with "nightly-next bounded notarization contract is missing: CMUX_NOTARY_WAIT_TIMEOUT: 40m".
• Green: it passes. The test_notarize_nightly_dmg.sh timeout bounds pass and actionlint is clean. cmux-next-guards runs the release-notary group on this PR.

Changelog

none

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Waits up to 40m for Apple notarization in the nightly-next job, matching main and RC, after three consecutive nightly-next builds outlasted the previous 20m wait and failed to publish in-job.

• Sets CMUX_NOTARY_WAIT_TIMEOUT to a flat 40m on every track instead of track-specific values.
• Updates the nightly universal build test to require the 40m contract.
• The step's 50m and the job's 80m timeouts already cover the longer wait; a wait that still times out hands off through the recovery artifact as before.

---

[!NOTE]
Low Risk
CI-only change to notarization wait duration in the nightly workflow; no app runtime or security logic is modified.

Overview
nightly-next no longer uses a shorter 20m in-job Apple notarization wait; CMUX_NOTARY_WAIT_TIMEOUT is now 40m on every track (main, RC, and nightly-next), matching the longer bound main/RC already used.

Workflow comments note that three consecutive nightly-next runs exceeded 20m, so builds were not stapled or published in-job. The existing 50m step timeout and recovery-artifact handoff on timeout are unchanged—only the wait cap increases so more builds can finish notarization in the same run.

tests/test_nightly_universal_build.sh was updated to assert the fixed 40m value instead of the old track-conditional expression.

^{Reviewed by Cursor Bugbot for commit 5ba51c8b38d8e16a4a3d230f80d9ca71321868e4. Bugbot is set up for automated code reviews on this repo. Configure here.}