#22238 cmux-next: the CI target graph is bot-only

Packages/macOS/CmuxNext/ci-target-graph.json is now bot-only: no pull request carries it. Part of #21946. Stacked on #22235, so merge that first; this branch includes its commits.

The graph went stale in PRs constantly. A PR's copy reflected the base at the moment the autofix ran, so as soon as the base added a target the copy was wrong. Seven open PRs carry one. On #21729 a later merge silently dropped CmuxNextChromiumWarmup, because the keep-one-side driver kept the stale copy. A PR doesn't need its own graph: a Package.swift change already routes every tier (cmux_next_route.py FULL_INPUTS), and so does a change to the graph itself. That means every PR carrying graph drift was also paying for full CI.

Change

• Ownership table: generated_outputs.py gives the graph no PR-side inputs. The PR autofix never pushes it, and the generated drift check fails a PR that changes it, with "only the base autofix writes it".
• cmux-next generated files: checks the graph only on pushes, batches and dispatches, not on pull_request.
• Base autofix: still regenerates the graph after each merge, and next_batch still rebuilds it.
• docs/ci/cmux-next-tiers.md: says the graph is bot-only.

Tests

• generated-ownership.test.sh was committed red first: a Package.swift change still let a PR carry the graph. It's green at the head.
• pr-autofix.test.sh passes, and actionlint is clean.
• tests/test_cmux_next_route.py errors with KeyError: 'CMUXAuthCore' in this sparse checkout. The test file is unchanged from the base, and routing isn't touched here.

Workflow file changes: Leo waived Lawrence's code-owner sign-off for this work, and Lawrence's coordinator was told.

Changelog

none

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Makes Packages/macOS/CmuxNext/ci-target-graph.json bot-only: no pull request carries it, and no CI event checks it. A PR's copy went stale as soon as the base added a target, causing conflicts and silently dropping CmuxNextChromiumWarmup in a merge; a Package.swift change already routes every tier, so a PR needs no graph of its own.

• A new scripts/cmux-next/generated_outputs.py maps each generated output to its inputs, with the graph having no PR-side inputs; the PR autofix never pushes it, and the ownership table covers every autofix output kind.
• A new generated drift check fails a PR that changes an output without its inputs and tells the author how to drop it; the generated-drift-ok label skips it (applies from the next push).
• The graph is stale between a merge that adds a target and the base autofix's rewrite, so its check and the regeneration step were removed from the workflow; the base autofix regenerates it after each merge and fails when it cannot.