#20509 ci: nightly-next signing and notarization recovery leave the PR macOS pool

Summary

Nightly-next has published nothing since 04:26Z (1.0.0-nightly.3850073942601). There were two causes:

1. Apple notarization slowed down. For the 05:39 build (run 38517827394), Apple accepted submission 5912557e-0420-437d-8e8e-aa6a36d1935b at 06:57Z, but it was still In Progress when the 07:42 recovery run checked. Earlier builds notarized in 6-7 minutes; this one missed the 40-minute wait, so the run correctly left it pending and skipped publish-nightly.
2. The recovery path waited behind PR CI.
   • recover-nightly-next-notarization and build-sign-notarize-nightly run on vars.MACOS_RUNNER_26, which is blacksmith-12vcpu-macos-26, the same pool as MACOS_RUNNER_PR.
   • The 08:14 continuation (run 38533686940) sat queued on that label.
   • The 07:36 build's sign job waited about 20 minutes for a runner.

This PR moves the four jobs that hold the signing environment to blacksmith-6vcpu-macos-26, which PR CI doesn't use: sign/notarize, notarization recovery, identity publish and deltas. That way a continuation or signing job never queues behind pull requests. The app build itself is unchanged.

Side effects:

• No failover to owned minis. These four jobs no longer follow MACOS_RUNNER_26, so when Blacksmith is down they wait for it instead of moving to an owned mini through cloud_overflow_switch.py. That is intended: production signing and notary secrets stay off owned minis.
• Shared quota. Blacksmith may cap concurrency across the whole org rather than per label. If so, a heavy PR backlog can still slow these jobs; this change only stops them queueing behind the same label.

Not in this PR:

• Concurrency is already cancel-in-progress: false. The "cancelled" runs are pending runs that a newer push replaced.
• Promotion is gated only on the Release compile passing, not on lint.
• A 30-minute schedule would have to live in main's workflow, because GitHub only runs schedule from the default branch. That needs the chief's yes.

Verification

• actionlint .github/workflows/nightly.yml passes.
• These tests pass: tests/test_ci_fork_runner_routing.py, test_runner_label_policy.py, test_nightly_next_recovery.py, test_nightly_next_notary_handoff.py, test_ci_production_secrets_protected_env.py, test_nightly_cmux_tui_resolve.py, test_nightly_next_computer_use_helper.py and test_ci_cloud_overflow_switch.py.

Changelog

none

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes nightly-next publishing stalls by moving the signing and notarization pipeline off the PR macOS runner pool. The sign/notarize, notarization recovery, identity publish, and delta jobs previously used vars.MACOS_RUNNER_26 (blacksmith-12vcpu-macos-26, the same pool as PR CI), so they queued behind pull request builds while Apple notarization was in progress and nightly-next published nothing. They now run on blacksmith-6vcpu-macos-26, which PR CI doesn't use. The app build itself is unchanged.