#25845 ci(nightly-next): Mac jobs fall back to hosted macos-26, not stalled Blacksmith

P0: nightly-next has had no publish since 19:38Z. Run 40434431701's build-nightly-app has been queued on blacksmith-6vcpu-macos-26 since 01:48Z. That pool is stalled: about 106 jobs queued and almost none running for 3 h.

On nightly-next only, the Mac jobs now take hosted macos-26 wherever they used to fall back to Blacksmith macOS. cmux is public, so hosted macos-26 is free, and it's trusted like Blacksmith: keys stay in the environment secrets. Classic run 40418933969 already built on it with the same Xcode.

• build-nightly-app and prepare-nightly-variant-primary: the owned side pool stays first when it's set. Otherwise hosted macos-26, then the old Blacksmith fallback.
• prepare-nightly-variant-fallback, build-sign-notarize, verify-signed, verify-final-dmg and generate-deltas: hosted macos-26 comes before the Blacksmith picker.
• main, RC and fork routing are unchanged. No label resolves to a single host.
• nightly.yml is 510,824 bytes, under the 512,000 limit.
• Tests: tests/test_nightly_trusted_routing.py updates the expectations and adds a check that every nightly-next Mac job lists hosted before Blacksmith.

Risk: hosted macos-26 has no warm compile cache, so the build is cold, but it runs now instead of waiting for hours. Once Blacksmith recovers, the Blacksmith-stall fallback (a separate PR) returns these jobs to the moving-queue picker.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}