#28223 carry of #27690: verify signed Computer Use hosts

Carry of #27690 (https://github.com/manaflow-ai/cmux/pull/27690).

Original purpose: “ci: verify signed Computer Use hosts against nightlies.” This carry keeps the signed NEXT nightly Computer Use host admission check and merges the current feat-cmux-next base to remove the fork-point red in the swift-test-summary self-test. The implementation commits and authorship are preserved; no selector or test workaround is added.

Validation: merge of current origin/feat-cmux-next completed cleanly. Fleet checks remain queued because the cmux-ci controller is timing out on submits.

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Carries PR #27690, adding a scheduled CI check that verifies signed Computer Use host admission against NIGHTLY app builds, and merges the current feat-cmux-next base to remove the fork-point red in the swift-test-summary self-test.

• The workflow downloads the signed NIGHTLY apps from the NEXT appcast, verifies their bundle identities and team signature, then starts each app with both Computer Use drivers and confirms the authenticated host socket stays open for 3 seconds.
• The check detects the effective driver NIGHTLY actually runs (no helper v2, so "upstream" uses the legacy helper) and speaks the legacy helper's machine_consent_host protocol.
• Unsigned, ad-hoc tagged, and exec-chain peers must receive the stable host_unverified refusal; the legacy refusal never says attached.
• The ad hoc and exec-chain probes use a small compiled C client, since /usr/bin/python3 is the xcrun shim and a copy named cmux ran the cmux CLI instead of speaking on the socket.
• The NEXT nightly feed is the blocking contract; the classic identity is retained as a best-effort diagnostic that does not fail the check.
• Registers the job in warm-sources.json as run-only (it compiles nothing) and classifies its Mac job as apple-gui in runners.json.
• The pick job now reads the pool from fromJSON(vars.RUNNER_POOLS).linux, since the prior LINUX_RUNNER with a fixed Blacksmith pair is refused by the Linux size guard.