ci(nightly): route publication bookkeeping through fleet picker
What changed
Leo's rule is: “each feed's newest published build is never more than 30 minutes behind the newest landing on its branch.”
Five secret-free NEXT publication and advisory controls now resolve through pick-nightly-build-runner: an owned fleet mini is selected first and its measured Blacksmith output is the bounded fallback. This removes their paid-only runner pins while preserving existing issue and action read permissions. The debt test now names only controls that still lack a fleet route, and a regression test rejects direct hosted or literal runner assignments for this group.
The visual-gate routing resolver is intentionally left on its existing trusted route because it reads the ci-routing-agent GLAEDA route credential; it needs an exclusive claim and cleanup mapping before moving to an owned mini. The published-in control likewise retains its explicit trusted-runner route because its pull-requests:write token requires the existing ephemeral trust mapping.
Validation:
python3 tests/test_ci_nightly_off_blacksmith.py(17 passed)python3 tests/test_nightly_trusted_routing.py(29 passed)python3 tests/test_ci_runner_set.py(2 passed)- YAML parse and
git diff --checkpassed - Fleet fast-check attempts 41270736530 and 41271017054 were cancelled during Blacksmith admission with no failed steps (runner_name empty); no test failure was observed.
The credentialed signer and publish jobs remain on their separate claim-gate companion work until their Glaeda hook pin is deployed.
Agent session: agent session
🤖 Generated with Claude Code