#25552 test(ci): forbid any concurrency group on DEV publish and tip; run the delivery guard in CI

Follow-up to #25398, which took the concurrency groups off cmux-next-dev-daily.yml publish and tip. On main those groups had cancelled publish and tip after sign and verify passed, in runs 40370485774, 40371402817, 40373347803 and 40378401600. Newest-wins now comes from an R2 lease plus a commit record (publish) and a feed compare-and-swap (tip).

Rulebook: "No cancel-in-progress: true and no evicting concurrency group on those workflows; a CI test enforces it."

What changed (test-only, plus wiring)

• tests/test_nightly_delivery_concurrency.py
  • Uses declarative lists: DELIVERY_GLOBS, REQUIRED_DELIVERY_WORKFLOWS and NO_CONCURRENCY_GROUP = {"cmux-next-dev-daily.yml": ("publish", "tip")}, with a comment that cites #25398 and the four runs.
  • Parses the YAML. The test fails on a top-level concurrency: or a job-level concurrency: on publish or tip, even a non-cancelling one, because a group replaces the pending run. It also fails if either job is renamed away.
  • Fails if nightly.yml or cmux-next-dev-daily.yml goes missing, so a rename can't drop coverage without anyone noticing.
  • The generic cancel-in-progress: true check is unchanged.
• The test was in UNWIRED, so no workflow ran it and the rulebook's "a CI test enforces it" was not true on main. It now runs in ci-guards.yml's release-notary group, next to the tip-feed test, and is removed from UNWIRED. feat-cmux-next already wires its copy the same way.
• tests/test_cmux_next_dev_tip_feed.py is untouched.

Bite proof (scratch edits, not committed)

• Added concurrency: {group: x, cancel-in-progress: false} to publish: exit 1, cmux-next-dev-daily.yml publish has a concurrency group.
• Added the same at the top level: exit 1, has a top-level concurrency group.
• Moved the workflow away: exit 1, cmux-next-dev-daily.yml is missing.
• Real file: exit 0, PASS.

Not covered: feat-cmux-next. Its copy of cmux-next-dev-daily.yml predates #25398 and still has cmux-next-dev-daily-sign and cmux-next-dev-daily groups. Its jobs only run when github.ref == 'refs/heads/main', so that copy is inert, and the no-group assertion there would need a workflow change rather than a test change.

Risk: low. One more guard step runs in release-notary. The test passes on the current head.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by CodeRabbit

• Tests
  • Expanded automated checks to cover required delivery workflows and verify that selected publishing jobs run without concurrency restrictions.
  • Added the checks to the continuous integration workflow, helping catch delivery configuration issues earlier.