#28197 carry of #27531: gate nightly recovery on tree marker

Carry of #27531: ci(nightly-next): build the tip at once and install its tree's attested client when the tree publishes.

Carries the nightly tree-at-install work onto current feat-cmux-next. The publish source selector now requires the current build's tree-marker eligibility before selecting it; a recovered build cannot bypass a failed marker gate. The carried tests cover marker-aware recovery selection.

Original PR: https://github.com/manaflow-ai/cmux/pull/27531

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Carries #27531's nightly tree-at-install work onto current feat-cmux-next. A nightly that starts before its tip's cmux-tui tree is published now compiles the app immediately, installs the tree's attested client once its manifest is uploaded, and publishes only after the build commit's tree-commit marker names the installed client's commit as the tree's publisher.

Behavior changes

• The publish source selector requires the current build's tree-marker eligibility before selecting it, so a recovered build cannot bypass a failed marker gate.
• publish-nightly evaluates its job condition with always() so a skipped marker-wait job still lets publication proceed.
• Recovery refuses a run whose marker check failed, was cancelled, or has not finished.
• The marker check also gates an unsigned resume, against the bundled client commit read from the resumed app archive, using a synthetic tree key.
• Sign variants now read the bundled client commit from build-nightly-app's output instead of the resolver's alone.
• request-nightly-next.sh requests such a tip at once while an artifacts run builds its tree.