#30278 ci(nightly): prefer proven dedicated publication mini

Leo asked: “FOR OUR NIGHTLIES ARE THEY END TO END ON OUR FLEET? WE CAN'T BE RELYING ON BLACKSMITH THAT CUTS OUT.”

This stacked follow-up to #30098 gives the three credentialed NEXT publication controls a dedicated-m4pro preference when all activation conditions hold: the same manaflow-ai/cmux repository, nightly-next, a push, attempt 1, and CI_NIGHTLY_ONLY_RUNNER=glaeda-nightly-only-m4pro. Existing fork, owned-pool, and measured Linux overflow routes remain in place.

The existing claim gate and post-checkout helper stay ahead of release credentials. The dedicated variable must remain unset until every eligible slot is registered with the exclusive claim-capable Glaeda hook; a runner without the exclusive claim or a hook absent from the pinned allowlist fails before any release token. This PR does not change signing trust, hook pins, or host enrollment.

Validation: local tests/test_nightly_trusted_routing.py (39), tests/test_ci_signing_owned_mac.py (23), tests/test_ci_fork_runner_routing.py (23), and tests/test_nightly_workflow_size.py (2) pass; the 490k legacy margin check remains the same named base red.
Review (subagent): SHIP at 66167e24f0c6381ffa576499c829ce5787106999

Uses #30098 claim controls; this PR adds only the dedicated publication preference and equivalent YAML anchors that preserve parsed workflow values while keeping the file below the 508k nightly guard.

Agent session: agent session
🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Routes the three credentialed NEXT publication jobs to the dedicated glaeda-nightly-only-m4pro runner when all activation conditions hold, so nightlies run end to end on our fleet rather than relying on Blacksmith.

The dedicated path activates only on manaflow-ai/cmux, the nightly-next ref, a push, run attempt 1, and vars.CI_NIGHTLY_ONLY_RUNNER=glaeda-nightly-only-m4pro. Forks route to GitHub-hosted ubuntu-24.04 instead of Blacksmith overflow. The three jobs also hold the whole Mac: the exclusive-claim gate and claim helper run after checkout, before any release credential, and the pooled owned_pool route stays empty until hook coverage is provable.

Migration

• Keep CI_NIGHTLY_ONLY_RUNNER unset until every eligible slot is registered with the exclusive claim-capable Glaeda hook; a runner or hook missing the claim fails before release credentials are read.
• Uses #30098 claim controls; signing trust, hook pins, and host enrollment are unchanged.