#30200 ci(nightly-next): keep visual verdicts advisory

Problem

Leo asked, “why are changes to these not in my current nightly”. The Nightly freshness rule requires each feed's newest published build to be no more than 30 minutes behind the newest landing. The visual gate's Linux verdict job was on publish-nightly's dependency path, so a display queue or enforce-mode verdict could hold publication.

Change

• Keep visual routing, capture, verdict, and issue reporting intact.
• Remove the visual jobs and their mode/blocks outputs from publish-nightly's needs, condition, and source selection.
• Record failed visual findings as advisory follow-up while allowing the verified nightly build to publish.
• Update the visual-gate design note and contract tests to enforce the advisory publication path.

The currently published source remains protected by the existing signing, DMG verification, feed CAS, and publication checks.

Validation: git diff --check; fleet checks will run on the exact head.

Agent session: agent session
🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Keeps the nightly-next visual gate advisory so neither publication nor recovery waits on a visual verdict, keeping the nightly feed within its freshness window.

• Removes the visual jobs from publish-nightly's dependency path, condition, and source selection; failed enforce verdicts are recorded as advisory follow-up.
• Recovery no longer refuses a build based on a recorded visual verdict; signing, notarization, and lineage checks remain the gates.
• Disables auto-promotion to enforce mode; without an explicit enforce, the gate reports indefinitely.
• Signing, DMG verification, feed CAS, and publication checks still protect the published source.
• Tightens contract tests to pin the advisory publication path and retains the signer picker dependency.

Review (gpt-6.1-sol): SHIP at a8a709126f3279c33c3706c90da19461d1b0f2aa