ci(nightly): route credentialed publication controls through owned Macs

TE
5d ago
+220-66

Leo asked: “why are changes to these not in my current nightly”. He also said our nightlies should run end to end on our fleet because we cannot rely on Blacksmith cutting out.

This repair makes the three credentialed NEXT publication controls enforce their owned-Mac claim contract without enabling an unverified shared-pool route:

  • publish-nightly, publish-nightly-next-github, and publish-nightly-next-github-names select and check out their source before the exact release claim gate, then run bash .publish-tooling/scripts/ci/signing-runner-claim.sh before any release App credential.
  • The existing per-runner owned signing pick is unchanged. sign_owned_pool is intentionally empty until a controller census proves every eligible listener has the exclusive-capable Glaeda hook; publication controls therefore retain their trusted 16/32-vCPU Blacksmith Linux fallback.
  • Forks use the same trusted publication fallback; none of these three release jobs routes to GitHub-hosted Ubuntu.
  • Signing-job accounting includes jobs carrying the shared owned-pool label, so the exclusive signing cap cannot be bypassed by a pool-only publication job.
  • The routing and claim-gate tests cover checkout ordering, exact gate text, helper placement, pool accounting, and the fail-closed publication output.
  • Identical claim steps share YAML anchors. This preserves the parsed workflow while keeping its size at 507,843 bytes, below the 508,000-byte headroom check.

The controller census needed to safely enable the shared publication pool is tracked in #30195. No runner trust or release-secret policy changes are part of this PR.

Validation at f75fd7e445c4279379134995b658d626a966db8c: 203 focused tests pass (owned signing 23, trusted routing 38, recovery 58, fork routing 23, fleet routing 20, routing table 32, dedicated-mini integration 7, nightly size/aliases 2), plus complete routing-table validation and git diff --check. The step-coverage suite has one identical base failure: resolve-nightly-cmux-tui-client / Record pending tree dependency lacks a registry entry. Running the same test against base workflows and registry produces the exact same problem list; the six publication claim/helper entries added here are covered. The older 490,000-byte margin check already fails on the integrated base (506,879 bytes); the 508,000-byte regression introduced here is fixed. Same-reviewer Astra SHIP at this final head. Fresh exact-head fleet run 41280699939 is pending; its terminal receipt will establish the result.

Agent session: agent session
🤖 Generated with Claude Code