#21900 ci(nightly-next): schedule the feed canary and register the rollback on main

This adds the main-branch half of the cmux NEXT nightly canary and rollback. The nightly code itself is in feat-cmux-next PRs #21887 (rollback) and #21890 (canary).

Both files must be on main for GitHub reasons:

• nightly-next-canary.yml checks each new build on the cmux NEXT feed on a CI Mac. A schedule runs only from the default branch, the same reason nightly-next-feed-watch.yml lives here. Every 15 minutes it:
  • downloads the exact DMG the feed names;
  • checks its length, notary tickets, Gatekeeper and build number;
  • runs smoke-signed-app-cli.sh --canary from the build's own commit: a visible window, a New Tab, a fake-agent session that answers a prompt, and no crash in the first 60 s.
  • Builds from before the canary are noted as skipped.
• nightly-next-rollback.yml is here only so GitHub lists it for dispatch. Its job runs only on nightly-next, where release-next (the feed's R2 token) deploys, so on main it does nothing. tests/test_ci_production_secrets_protected_env.py now requires that environment for it.

Both files are byte-identical to the feat-cmux-next PRs. Nothing changes behavior until NIGHTLY_NEXT_CANARY is set:

Value	Effect
unset / report	A failed canary is an annotation plus one nightly-next canary failed issue.
enforce	A failed canary also dispatches the rollback for that build.
off	Skips the canary.

Order: merge #21887 and let promotion carry it to nightly-next before setting enforce. Until then, a dispatch to nightly-next has no workflow file to run, and the issue says so.

Testing:

• actionlint is clean on both files.
• test_ci_production_secrets_protected_env.py passes.
• The canary job ran green on feed build 3917159104301 from #21890 (run 39195075343).
• On main, this PR's own pull_request run uses main's smoke-signed-app-cli.sh, which has no --canary yet, so it reports "predates the canary". That shows the routing works, not the checks.

Changelog

none

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds the main-branch half of the cmux NEXT nightly canary and rollback, so the canary runs on a schedule from main and the rollback workflow is registered for dispatch.

• The canary runs every 15 minutes, downloading the exact DMG the feed names and checking its length, notary tickets, Gatekeeper, and build number, then runs the canary harness from the build's own commit.
• NIGHTLY_NEXT_CANARY controls the failure mode: unset/report opens or comments on one nightly-next canary failed issue, enforce also dispatches the rollback, off skips the canary.
• The rollback workflow's job runs only on nightly-next, where release-next holds the feed's R2 token; it is registered on main only so GitHub lists it for dispatch. The write uses If-Match so a concurrent publication is never overwritten.
• tests/test_ci_production_secrets_protected_env.py now requires release-next for the rollback job.

Migration

• Merge the feat-cmux-next rollback PR first; until it lands on nightly-next, an enforce dispatch has no workflow to run.

Summary by CodeRabbit

• Chores
  • Nightly-next builds are checked for download integrity, platform security acceptance, and successful test runs. Checks can run on a schedule, manually, or for pull requests.
  • Scheduled checks skip builds already recorded in the cache. Failures outside pull requests can be tracked and, when enforcement is enabled, trigger a rollback request.
  • Rollbacks can be previewed or applied by selecting a build to remove or retain. Safeguards prevent overwriting a feed that changed during the process, and the updated feed is verified afterward.