ci: route nightly preparation through fleet placement
NEXT nightly preparation currently resolves to fixed Blacksmith Linux labels. That leaves portable, secret-free preparation work waiting on paid capacity even though the nightly placement step already selects free owned minis.
This routes prepare-nightly-variant-primary and prepare-nightly-variant through the existing bounded nightly placement. They use an idle owned mini when selected and retain the measured Blacksmith Linux expression as overflow. The placement waits up to five minutes only while runner inventory and the janitor snapshot are fresh; unknown or stale capacity falls through immediately to Blacksmith. Attestation remains on its trusted Blacksmith route because it needs id-token and attestations: write. The routing table and debt guard classify both preparation jobs as portable checks. The current REQUIRE_LIVE_CAPACITY contract from #30173 is preserved for preparation overflow and the existing admission fallback remains unchanged.
Leo said: “PUBLISH THE F***ING NIGHTLY” and asked where the efficiency improvements were. This removes two avoidable Blacksmith-only waits without changing secrets, permissions, signing routes, or promotion behavior.
Validation: tests/test_nightly_linux_admission.py (25), tests/test_runner_routing_table.py (27), tests/test_ci_portable_job_placement.py (30), tests/test_nightly_trusted_routing.py (33), and tests/test_gh_budget_wait.py (27) pass locally; git diff --check is clean. Fleet fast-check is being rerun at the rebased head.
Agent session: agent session
🤖 Generated with Claude Code