#24621 ci: remove smoke gates from nightly and release

Changelog

• Changed: remove app, CLI, daemon-start, and DMG launch smoke gates from nightly and release publication paths.
• Changed: replace exact-DMG launch verification with static digest, stapler, Gatekeeper, metadata, and license checks.

Leo said: “we want no smoke tests.” This PR keeps deterministic artifact and source-contract checks, leaves daemon/app behavior in the path-routed integration lane, and removes the prepublication NEXT canary plus its orphan-process cleanup.

Before, from the same gh-events.cmux.com/ci-timing.json source: nightly run 39944176065 at head 75129b8096b1cd2e29915b87ea9f31e4cc3a2cde took 64.40 wall minutes; signed launch 16s, CLI 9s, canary 63s, final-DMG smoke 109s, and legacy-DMG smoke 99s. Seven-day complete-run p50/p90 was 67.0/72.9 minutes. Release had no run in the seven-day window, so its before receipt is explicitly unavailable.

After timing will be appended from the first exact changed-head nightly/release receipts; no post-change number is claimed here until that run exists.

Validation: YAML parse for all changed workflows; bash -n for both verifier scripts; tests/test_nightly_universal_build.sh; tests/test_ci_signing_keychain_is_deleted_before_bundle_code.py; tests/test_nightly_notices_submodule.py; tests/test_nightly_artifact_alias.py; tests/test_nightly_next_canary_mode.py; fake-tool static-DMG receipt test.

Agent-Session: 01a16a8a-ef97-7682-b6e9-a79f24ced688

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Removes runtime smoke gates from nightly and release publication, replacing app launch, bundled CLI, and canary checks with static artifact verification that never executes bundle code.

• Nightly and release now verify the exact signed DMG via sha256, stapler ticket, Gatekeeper, channel metadata, and license checks (scripts/ci/verify-dmg-artifact.sh).
• Removes the pre- and post-publication canary runs, the enforce-mode rollback dispatch, and the orphan-process cleanup steps.
• The scheduled post-publication verifier caches each build's verdict so already-checked builds are skipped on later runs.
• check-daemon-capabilities.sh gains --static-only for distribution workflows, validating the bundled capability manifest against all required and unconditional optional static capabilities while exempting only runtime-installed ones; the sidecar protocol check keeps its handshake assertions after the signing keychain is deleted.
• Runtime behavior coverage stays in the path-routed daemon/app integration lane; publication still gates on the secret-free static verification jobs.