#25957 ci(nightly-next): move legacy identity after publication

The cmux NIGHTLY-identity compatibility copy now starts after publish-nightly, so its independent re-sign, notarization, and verification cannot contend with the primary publication or delay the first NEXT appcast. The existing downstream publication keeps its exact-build and live-feed checks.

Measurement: the same workflow graph changes the number of legacy identity submissions eligible before primary publication from 2 to 0 (two Apple submissions moved after publish-nightly). A controlled elapsed-minute before/after measurement is unavailable because no comparable nightly run was published during this change.

Validation: python3 tests/test_nightly_next_post_publish.py; YAML parse; git diff --check.

Agent session: agent session