ci: verify signed Computer Use hosts against nightlies
Fixes HQ#5110.
Computer Use host admission previously had only mocked signature coverage. This adds a fleet Mac check that downloads the current signed NEXT NIGHTLY artifact, verifies its bundle identity, Apple signature, and embedded com.cmuxterm.cua helper, then launches the app with both Computer Use drivers enabled. The running signed app must keep its host connection; unsigned, ad hoc tagged DEV-shaped, and post-connect exec peers must receive host_unverified.
The supported NEXT appcast is the blocking contract. The legacy com.cmuxterm.app.nightly appcast remains a best-effort diagnostic while it is published; download, signing, or runtime failures there are reported as informational and cannot red the job. This keeps the retired classic feed from blocking NEXT.
The check runs hourly and on dispatch/PR changes through the existing side-lane picker. The picker chooses an idle owned Mac or a moving Blacksmith slot; when neither has a usable route, the run records skipped: no host and the Mac job is skipped instead of queueing on a saturated side label. It selects the pinned Xcode on the chosen Mac and has no GitHub-hosted Mac fallback.
The stable wire refusal is asserted; the detailed ad hoc reason remains an app log/unit-test diagnostic because the protocol intentionally exposes only host_unverified. The signed helper bundle is verified as com.cmuxterm.cua and explicitly kept outside the accepted main-app identity set; the real host peer path is exercised with the signed NEXT app.
Leo asked for a fleet Mac test against real signed NIGHTLY builds so a signing or bundle-id change that breaks acceptance fails before shipping.
Validation: python3 tests/test_ci_actionlint_covers_every_workflow.py, python3 tests/test_ci_runs_on_fallback.py, python3 tests/test_ci_side_lane_placement.py, python3 tests/test_ci_macos_xcode_selection.py, python3 tests/test_ci_no_github_hosted_macos.py, python3 tests/test_ci_workflow_guards_are_wired.py, python3 -m py_compile scripts/ci/cua_signed_host_check.py, and git diff --check.
š¤ Generated with Claude Code
Agent session: agent session