fix(nightly): keep DMG signer on trusted Linux route
Takes back #29801: restore the existing signer route until its owned-Mac keychain and exclusive admission are implemented.
The nightly DMG signer is back on its existing Blacksmith Linux route (16 or 32 vCPU; ubuntu-24.04 applies only to forks). The merged Mac route depended on a glaeda signing admission that does not include signer-dmg; it could therefore fail before signing and stall publication.
This fix-forward removes the unused native Mac signer build and the owned-Mac claim path, restores the Linux signer artifact and checksum flow, and keeps the warm-source declaration for the signing job. The owned-Mac signing guard no longer grants a release-signer exception: a future Mac route must first provide a per-job keychain and unconditional cleanup. That design is tracked in HQ research issue #5742.
Leo asked, “why are changes to these not in my current nightly”; the freshness rule keeps each feed’s newest published build within 30 minutes of its branch tip.
Validation: python3 -m unittest tests/test_nightly_signer_jobs.py tests/test_nightly_sign_runner.py tests/test_ci_nightly_off_blacksmith.py tests/test_ci_signing_owned_mac.py tests/test_ci_signing_keychain_is_deleted_before_bundle_code.py tests/test_release_signer_scripts.py (113 passed); python3 tests/test_ci_warm_sources.py (12 passed); git diff --check.
Agent footer: agent session
🤖 Generated with Claude Code