#28764 fix(ci): nightly's tree resolver finds trees published under compatibility keys (#28214 review)

Fixes the blocking review on #28214 (receipt: https://github.com/manaflow-ai/cmux/pull/28214#issuecomment-6537167606), which landed before the finding was acted on:

Changing v2 also changes historical keys, but resolve_newest_published_tree() still checks only v2. Existing publications containing cmux-tui/docs become invisible to this resolver. When the new canonical publication is unavailable, nightly builds lose their previously working fallback and can fail despite valid published artifacts. Add compatibility-key lookup to the history resolver and return the actual published key.

resolve_newest_published_tree (scripts/cmux-next/pin-cmux-tui.sh) now tries, for each commit in its window, the v2 key and then that commit's compatibility keys (legacy_tree_key: v2-legacy, then v1), the same order read_tree_digest already uses for fetch and resolve-commit. The first verified publication wins, and key= reports the key actually published. Each candidate is still verified once (good/bad key caches are per candidate).

This is a fix-forward, not the revert in #28714: that revert's own review found the pre-#28214 workflow requires a v1 key that current revisions no longer have, so #28714 is on HOLD.

Testing

• scripts/cmux-next/tests/pin-cmux-tui-resolve-newest.test.sh gains a case: a commit containing cmux-tui/docs is published only under its v2-legacy key. Before this change it fails (the resolver skips it and returns an older v2 tree); after, it resolves with key=<v2-legacy key> and that commit as publisher.
• Passed locally: pin-cmux-tui-resolve-newest, tree-key-v2, tree-publish-v2, pin-cmux-tui-fallback-key.
• Python suites (test_nightly_cmux_tui_resolve, test_cmux_next_media_tree_fallback, test_tui_publish_workflow_security) and resolve-tip-wait run on fleet Linux; result in a follow-up comment.

risk: normal (CI script; the nightly's resolver only gains fallback keys it already reads elsewhere).

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the nightly history resolver so it can still fall back to trees published before the v2 tree key changed, preventing nightly builds from failing when the new canonical publication is unavailable.

resolve_newest_published_tree now tries each commit's v2 key first, then its compatibility keys (v2-legacy, then v1) — the same order read_tree_digest already uses — and reports the key actually published. Previously it only checked the v2 key, so older publications (e.g. containing cmux-tui/docs) were skipped. This is a fix-forward; the revert in #28714 stays on hold because the pre-#28214 workflow requires a v1 key that current revisions no longer have.

Adds a test fixture where a tree is published only under its v2-legacy key; it fails before this change and passes after.