ci: free Mac build slots from portable nightly work
Nightly daemon builds, manifest generation, artifact uploads and advisory attestation occupied the Mac app-build slot. The daemon now builds with the existing pinned, CGO-disabled Go script in a Blacksmith job; preparation waits for its artifact. Attestation runs separately without blocking signing or publication. Unsigned resumes keep their original assets.
The portable performance-completeness tests also move from the Mac fast tier to its existing cargo job. The Mac seed runs only Swift entries.
Validation after rebase: nightly source-selection, budget-workflow guards (5 tests), nightly step coverage (5), unsigned resume (17), universal-build contract, recovery failure reporting (9), fast-tier routing and warm-seed routing (17 combined) pass. The budget guard checks the separate Blacksmith attestation job and asserts that no job depends on it. Portable performance-completeness tests passed before rebase. The pre-push gate reports no new violations. Local verification has existing localization debt in untouched catalogs. Real daemon cross-build validation could not run locally (Go unavailable); explicit CI dispatch was unavailable. Normal PR CI is running. No nightly was dispatched.
Measurement: replaying the same step durations from run 40380339203 against the before/after runner assignments gives 31 → 0 Mac-seconds (0.517 Mac-minutes saved) for attestation and upload alone. This excludes the 36-second combined daemon-build/metadata step because metadata remains on the Mac. It is a recorded-duration routing comparison, not a live post-change nightly measurement.
A newer timing sample from run 40443377291, attempt 2, job 121989336894, records 1.07 seconds reserving budget, 3.5 seconds attesting and zero seconds of budget sleep. The same routing replay gives 4.57 → 0 Mac-seconds (0.076 Mac-minutes freed) for those two steps. The one-hour wait is a configured bound, not an observed saving.
Audit: release notes, appcasts, manifests, publication, promotion checks and dSYM archival already run off Mac; legacy publication moved in #25824. Remaining Mac jobs compile with Xcode, sign/notarize, inspect or mount Apple artifacts, run Darwin binaries, or generate Sparkle deltas. Preparation migration from #25885 is preserved by the rebase; this change only adds its daemon-artifact dependency. Sentry upload stays with the compile because --include-sources resolves original compilation paths; copying all referenced sources risks transferring Apple SDK headers. An earlier attestation extraction (#22409, closed unmerged) blocked publication on quota waits; this one preserves advisory provenance.
Risk: the daemon artifact now crosses a separate job boundary, covered by the unchanged artifact name, resolved source pin and preparation dependencies. Provenance may become available after publication.
Performance
No perf numbers: this PR moves CI jobs between runners and changes no app code. It frees Mac build slots and does not change any measured interaction.
Changelog
none
Agent session: agent session