#21166 ci: prepare trusted nightly-next pool rescue on main

Nightly NEXT currently cannot be rescued from a persistent worker: main's watcher only admits nightly runs on main, and the runner-variable guard rejects a dedicated NEXT runner. This adds the separate CI_NIGHTLY_NEXT_TRUSTED_POOL/CI_NIGHTLY_NEXT_TRUSTED_RUNNER pair to the policy and watches same-repository nightly-next pushes on attempt 1. A stalled or refused job falls through to its hosted retry, and supersession stays within its own branch.

This is the main-side prerequisite for the feat-cmux-next workflow change. It changes no runner assignment and activates no variable. Keep NEXT routing disabled until that workflow and the narrow worker admission hook are deployed and verified; signing remains hosted.

Validation: the NEXT rescue and label regressions fail at 001066ab3b0 and pass at ec648dcd907; 136 rescue tests, 32 runner-label tests, actionlint on all three changed workflows, and git diff --check pass. No native build is required for this portable routing policy change.

Changelog

none

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Enables the CI pool rescue to admit nightly-next builds on their own trusted runner, without changing any current routing.

The rescue watcher previously only admitted nightly runs pushed to main. It now also admits same-repository nightly-next pushes on attempt 1, guarded by the new CI_NIGHTLY_NEXT_TRUSTED_POOL/CI_NIGHTLY_NEXT_TRUSTED_RUNNER variable pair. Supersession stays within the nightly-next branch, and refused or stalled jobs fall through to their hosted retry. This is the main-side prerequisite for the NEXT workflow change; the variables stay unset, so NEXT routing remains disabled until the workflow and worker admission hook are deployed.

The self-hosted runner guard now exempts only the complete NEXT trusted selector in nightly.yml, and the runner-label policy accepts the new variable pair.

Summary by CodeRabbit

• New Features
  • Eligible nightly runs on nightly-next can be routed to trusted runners and retried on hosted runners if a build is refused or stalls.
• Documentation
  • Clarified nightly-next routing requirements and restrictions: schedules are not eligible, and trusted-runner variables must remain unset until support is ready.
• Tests
  • Added coverage for nightly-next routing, retries, supersession checks, and trusted runner-label validation.