cmux NEXT: repin app FFI after durable machine-group removal
This completes the documented two-step FFI flow after #25170: the app now links the published reducer that preserves an explicit machine-group removal. The diff changes only the CCmuxAppFFI URL and checksum in Package.swift.
Source: 619b1a3c815467557791a743a4f4475e9ab20a23. Exact build run compiled and tested the xcframework. Its final publish verification hit the installation API rate limit after publishing; the prerelease under a protected tag exists. Anonymous SOURCE_SHA, SHA256SUMS, and a full 12,590,231-byte ZIP download agree with the build checksum b68613ebc46fe2fecb2af826fa3c0e4827a245b2c167493ff5f7bcf93f8f1e60.
Validation: scripts/cmux-next/check-app-ffi-pin.sh --verify-release passes; final-head prepush gate and git diff --check pass. Independent Codex gpt-6-astra xhigh review: SHIP at 3ce892c8835de438e5726c924819d93fd71ee992, no findings. Root primary review agrees; the artifact source, immutable tag and anonymous archive checksum were verified independently. No local native build ran.
Base-red reconciliation: both the release-note validation failure and the release-compile shell-stub flag mismatch reproduce on untouched 4bf68b0eae7. The native app/Swift jobs are still queued or running; no extra run was dispatched. The FFI pin check itself passes.
Changelog
Use the newly published app FFI containing durable machine-group removal.
Agent session: big-red