#29801 Route nightly DMG signing through fleet Macs

signer-dmg was pinned to Blacksmith Linux even though it receives release signing credentials, and the nightly Blacksmith-only debt test exempted it. That left a secret-bearing job outside the nightly fleet-first routing rule.

This routes the DMG signer through the existing drained owned-Mac signing picker, with the moving Blacksmith macOS label as overflow. The release environment is not widened to fleet Linux: this job keeps certificate and notarization credentials on the trusted signing Macs, in line with the rulebook's Linux, owned Macs, Blacksmith order and temporary credential handling. The checksum and base64 steps now work on both GNU/Linux and macOS. The routing and signing guards cover the regression and the Blacksmith debt exemption is removed.

Leo said: "why are changes to these not in my current nightly" and the freshness rule requires each feed's newest published build to stay within 30 minutes of the newest landing on its branch.

Validation: python3 -m unittest tests/test_nightly_signer_jobs.py tests/test_nightly_sign_runner.py tests/test_ci_nightly_off_blacksmith.py tests/test_ci_signing_owned_mac.py tests/test_ci_signing_keychain_is_deleted_before_bundle_code.py tests/test_release_signer_scripts.py (113 passed); workflow YAML parse and shell syntax checks pass.

Agent footer: agent session
🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Routes the nightly DMG signer through the fleet's owned Mac signing pool instead of pinned Blacksmith Linux, since the job holds release signing credentials and previously sat outside the nightly fleet-first routing rule. The Blacksmith macOS picker is now its overflow runner; fleet Linux is not added to the release environment.

Details

• New signer-build-macos job builds the macOS-native rcodesign artifact, since the Linux ELF cannot run on the Mac signing path; signer-dmg installs from that artifact.
• A claim-gate step holds the whole owned Mac before any credential and verifies the exclusive signing claim and the glaeda hook.
• The checksum, base64, and certificate-comparison steps are now portable across GNU/Linux and macOS, and the appcast generator skips its redundant OpenSSL Ed25519 check on macOS because the pure Python verifier runs right after.
• Tests updated to cover the new routing, the macOS build job, and the removal of the Blacksmith-only debt exemption for signer-dmg.