#21161 ci: resume saved unsigned nightly-next builds without recompiling

Summary

A successful 24-minute compile was stranded when its signing job failed. Dispatching nightly.yml on nightly-next with nightly_next_unsigned_run=38861055292 and nightly_next_unsigned_attempt=1 now restores that run's unsigned app and its original helper, daemon, licenses, and source offer. Compilation, dependency setup, and cache writes are skipped. Signing and publication use the existing guarded jobs with the original source SHA, version, and build number (3886105529201).

The resume accepts only a completed same-repository protected nightly-next push with successful producers in the exact requested attempt. Each artifact must match that producer's time window, source metadata, and SHA256 digest. Both source commits must be ancestors of the current protected control commit. A newer feed rejects the resume before signing. Signing uses the current workflow commit's keychain helper and its dependencies, so the failed old import code is not replayed. The resumed run retains a provenance receipt and fresh copies of its inputs.

Testing

• Red regression commit 584f8113866: the downloader accepted an artifact with no SHA256 digest. The same focused command passes after the fix.
• All 16 focused tests pass, covering source/run/attempt rejection, missing or modified artifacts, source identity across later failed-job reruns, version preservation, ZIP escapes, zero-compilation routing, ordinary compilation routing, conflicting mode rejection, and current signing controls.
• Live read-only preflight accepts run 38861055292, attempt 1, with source SHA f1e69326a704ace777fe43a6b470dc6203b98072 and build 3886105529201.
• Existing nightly decision, identity (7), publication marker (4), notices, signing-keychain lifetime, universal-build, resolver, and source-archive guards pass. All 19 release-notary command groups from the resume test onward pass locally. The defaults snapshot check passes after preserving the bot snapshot update. Guard expectations now explicitly allow the resume-only Linux/control-checkout path while retaining the native build gates. actionlint nightly.yml and git diff --check pass.
• Full portable preflight reports localization, localization-defaults, and workspace-package-group errors in untouched files. actionlint ci-guards.yml reports the existing undefined fast-guard step; the identical error reproduces on the base file. No native build, signing, notarization, or publication was performed.

Changelog

none

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds a resume path for nightly.yml so a failed signing job can recover an already-compiled unsigned nightly app without rebuilding. Dispatching on nightly-next with nightly_next_unsigned_run and nightly_next_unsigned_attempt restores the original app, helper, daemon, licenses, and source archive from the completed push run, then signs and publishes using the original build number.

• Resume reads the pinned historical attempt's jobs and artifacts, never the run's mutable latest view, so a later failed-job rerun cannot erase an earlier successful compile; sparse or partial provenance lookup is refused.
• Resume requires a completed same-repository nightly-next push whose producers succeeded in the exact attempt, with all artifacts verified by SHA256 digest and whose source commits are ancestors of the current control commit.
• Signing uses the current workflow commit's signing controls; source-bound notices and entitlements stay at the original commit.
• Artifact downloads now refuse inputs without a recorded SHA256 digest instead of falling back to size-only verification.
• Resume runs on Ubuntu runners and skips all compilation, dependency setup, and cache writes.
• Runs the resume tests in ci-guards.yml alongside the existing nightly guards.
• Regenerates schemas/defaults/cmux-next.json to add the rowHoldEnabled default flag.

Migration

• After deploying, rerun jobs in .github/workflows/nightly.yml that reference the new input.