#21167 ci: retain NEXT Release builds on a trusted nightly worker

Every nightly-next app compile currently falls through to an ephemeral Blacksmith worker, so its Release database and intermediates disappear. This routes attempt 1 of a same-repository NEXT push to a separately configured trusted runner and retains the complete Release state, Swift packages and byte-identical input timestamps across checkout cleanup. Forced web bundles still rebuild from the current source; changed source/resource bytes keep fresh times.

The NEXT selector requires a validated trusted pool, an exact runner and glaeda-trusted-next-nightly, a capability installed only with the narrow NEXT admission wrapper. Retries, dispatches, fast builds and unset configuration keep the hosted fallback. NEXT has no signing environment, skips shared restores on its trusted worker and never writes main's shared compilation/package caches. Classic NIGHTLY and hosted signing keep their existing routes.

Activation prerequisites: main-side rescue and variable-policy PR #21166, then the managed runner hook/capability deployment and an online eligible worker receipt. Keep NEXT variables unset until those prerequisites are green. Unsigned-resume PR #21161 must land before final integration; its initial Ubuntu branch will be preserved and its runner case must execute before merge.

Validation: the routing/rescue/label regressions fail at a23a00ba831; current source passes 134 rescue tests, 36 label tests, 3 retained-state behavior tests, 6 routing/cache/guard cases (the unsigned-resume case awaits #21161), the nightly universal shell guard, actionlint on nightly/rescue, and diff whitespace checks. Native compilation has not run locally. Existing ci-guards.yml actionlint failure at line 651 (steps.fast-guard) reproduces on the base ac4f2e36fae; broad runner guard failures in other workflow files are outside this change.

Changelog

none

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Keeps nightly-next Release builds on a dedicated trusted runner so the build database, intermediates, Swift packages, and byte-identical input timestamps survive checkout cleanup instead of recompiling from scratch on ephemeral Blacksmith workers.

• Attempt 1 of a same-repository nightly-next push routes to a runner carrying CI_NIGHTLY_NEXT_TRUSTED_POOL, CI_NIGHTLY_NEXT_TRUSTED_RUNNER, and the glaeda-trusted-next-nightly capability; main's selector and hosted signing are unchanged.
• scripts/ci/nightly_build_state.py keeps state outside the workspace, replays recorded mtimes only for byte-identical inputs, and dates changed ones, falling back to fresh inputs when retained state is missing or corrupt; forced web bundles still rebuild from current source.
• NEXT skips shared compilation and Swift package cache restores and saves only on its trusted worker; hosted fallbacks, including overflow, keep restoring, while the next track never writes shared caches or takes the ci-cache-writer environment.
• The owned-pool rescue and runner-label policy now cover nightly-next pushes, nightly-next gets its own concurrency group so pending runs don't block main's, and docs/guard tests pin the new capability tuple, with the architecture recorder test updated for the state-replay calls.

Migration

• Activation needs the main-side rescue and variable-policy support, the managed runner hook and capability deployment, and a healthy eligible worker; keep the new variables unset until those are green.
• The unsigned-resume change must land before final integration, and its runner case must run before merge.