#27485 ci(owned-pool rescue): cover feat-cmux-next's sign-nightly-identity-legacy-blacksmith job

Fixes a red in CI fast guards that every main PR now hits (for example #27022, run 40924337122):

FAIL: test_every_nightly_sign_verify_and_dmg_job_on_blacksmith_macos_is_rescued (tree='origin/feat-cmux-next')
{'sign-nightly-identity-legacy-blacksmith': 'not in NIGHTLY_SIGN_ALTERNATES'}

#27357 (merged into feat-cmux-next) added sign-nightly-identity-legacy-blacksmith, a same-run Blacksmith signer that takes over when the owned-Mac legacy identity attempt is refused. The test reads both branches' nightly.yml and requires main's scripts/ci/owned_pool_rescue.py to know every Blacksmith macOS sign or verify job, so the rescue can move it off a stalled label and the job can't hold the run's other stalled jobs in place. This adds the job to NIGHTLY_SIGN_ALTERNATES with _LEGACY_ALTERNATE, which its runs-on already has.

Risk: low. The rescue only touches this job when it is queued with no runner past the Blacksmith stall time and every other job in the run has finished. The job has if: github.run_attempt == 1, so a rescue re-run skips it. The re-run also re-runs sign-nightly-identity-legacy, which failed its claim gate on attempt 1, and on attempt 2 that job signs on the legacy alternate label, so the legacy DMG is still signed once. Without the entry the job stays queued, and as unfinished work it also keeps the rescue from moving the run's other stalled signing jobs.

Tests: tests/test_ci_owned_pool_sources.py and tests/test_ci_owned_pool_rescue.py pass locally.

🤖 Generated with Claude Code

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the red test_every_nightly_sign_verify_and_dmg_job_on_blacksmith_macos_is_rescued guard that hits every main PR since feat-cmux-next added sign-nightly-identity-legacy-blacksmith.

Registers sign-nightly-identity-legacy-blacksmith in NIGHTLY_SIGN_ALTERNATES with _LEGACY_ALTERNATE, matching its runs-on. The job only runs on attempt 1, so a rescue re-run skips it and re-runs the failed legacy signer on its alternate label. The rescue only acts when the job is stalled and nothing else in the run is pending, so impact is minimal.