#28548 ci(signing): trust glaeda runner hook 3b7fc168

glaeda pins these runner hooks (glaeda-disk's CMUX_NEXT_DRAIN_HOOK_SHA256), and scripts/ci/glaeda-signing-hooks.txt does not list them yet. Until it does, owned-Mac signing jobs on minis that run them fail their claim gate, and each run's Blacksmith twin signs.

• 3b7fc168de010536643ec01c34592c5487ff9a89776b434fa32b6db39aaf63f5: glaeda 63ace48b: runner-hook: a signing job its claim gate would refuse is refused before it drains the mini (#1761)

Check before landing: each sha is the sha256 of scripts/glaeda-cmux-runner-hook at a reviewed glaeda main commit, and that hook still waits out an earlier job's leftover processes and gives signing jobs the exclusive claim. tests/test_ci_signing_owned_mac.py checks that every listed sha is a glaeda pin.

Written by cmuxterm-hq .github/workflows/fleet-reconciler-glaeda-signing-hooks.yml (tools/fleet-reconcilers/glaeda_signing_hooks_sync.py). It updates this branch when glaeda pins another hook, and never merges.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds glaeda runner hook 3b7fc168 to the trusted signing hooks list so owned-Mac signing jobs that run it pass their claim gate instead of failing it and having each run's Blacksmith twin sign.