#25887 ci(nightly): no nightly, promote or DEV path resolves to a GitHub-hosted Mac

Leo: "HOW MANY TIMES DO I HAVE TO SAY / THE GITHUB HOSTED MACS / ARE THE SLOWEST THINGS / THEY PREVIOUSLY WREN'T EVEN UNDER CONSIDERATINO"

The routing order is Linux, then owned fleet Macs, then Blacksmith macOS last. GitHub-hosted macOS is never used on any nightly, promote or DEV path.

• New guard test: tests/test_ci_nightly_no_hosted_mac.py, wired into ci-guards (release-notary) and tests/test-execution.toml.
  • It finds its workflows by file name, with no job list: *nightly*.yml, *notarization*.yml and cmux-next-dev-daily*.yml.
  • It fails on any hosted macOS label (macos-NN, macos-latest, macos-NN-xlarge) in code lines past the fork branch: runs-on, matrix values, runner inputs, defaults and inline picks.
  • It applies the same rule to the runner-picker scripts whose outputs a runs-on reads, and fails if one references a HOSTED label.
  • It runs nightly_sign_runner.pick with no snapshot and with every label stalled, and requires a Blacksmith answer.
  • Blacksmith and Warp labels aren't hosted. The fork branch (github.repository_owner != 'manaflow-ai' && 'macos-NN') is exempt, because it only evaluates in forks.
• Hosted labels it would catch, now moved to Blacksmith: each one falls back to vars.MACOS_RUNNER_26 or vars.MACOS_RUNNER_15, then the Blacksmith label, after the fork branch and any owned runner variable:
  • auto-resume-nightly-notarization.yml (5 jobs) and resume-nightly-notarization.yml (2)
  • nightly-next-canary.yml
  • nightly-next-train.yml: NIGHTLY_NEXT_TRAIN_RUNNER stays first
  • ios-internal-nightly.yml: CI_IOS_INTERNAL_RUNNER stays first; the ephemeral signer moves to Blacksmith, which is trusted like hosted, so the key stays off owned Macs
  • cmux-tui-nightly.yml's macos_retry_runner
  • nightly.yml: refresh-compilation-cache (the job and its matrix) and the ghostty CLI helper (macOS 15)
• nightly.yml grows by 217 bytes, to 507,246, under the 512,000 limit.

Risk: these jobs now wait on Blacksmith macOS where they used to take a free hosted Mac. A hosted macOS 15 image and a Blacksmith macOS 15 image can carry different Xcode installs, so the ghostty helper is the job to watch.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}