#21577 ci(next): keep post-publication checks off the feed gate

What changed

Keep cmux NEXT's user-facing feed publication independent from slower post-publication checks. The macOS 15 launch probe and legacy-identity lane now consume a successful publish-nightly result instead of being able to participate in the feed gate.

This is scoped to the nightly-next publication path; classic NIGHTLY dependencies are unchanged.

Validation

• python3 tests/test_nightly_next_post_publish.py
• git diff --check
• No native macOS build run locally.

Changelog

• Changed: publish the NEXT feed before advisory macOS 15 and legacy-identity checks.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Keeps the nightly-next feed publication independent from slower post-publication checks so user-facing packages are not gated on them, and serializes the feed writers so overlapping runs cannot overwrite each other's mutable uploads.

• Gives NEXT workflow runs a run-scoped concurrency key, so macOS 15 launch coverage and the legacy-identity lane cannot hold the publication behind this workflow.
• Adds per-release-channel concurrency groups to republish-nightly-deltas and publish-release-notes, letting an in-flight publication finish before the next starts, and makes both writers recheck the live feed so stale notes or deltas are not uploaded after a newer publication.
• Adds tests/test_nightly_next_post_publish.py asserting the post-publication jobs depend on publish-nightly without becoming its dependencies, and extends tests/test_nightly_trusted_routing.py to verify independent-run concurrency.
• Scoped to the nightly-next path; classic NIGHTLY dependencies are unchanged.