#30648 ci(fast-checks): add live fleet admission tooling

ci: keep fast-checks admission tooling on the fleet first

The main fast-checks workflow needs a reviewed live-capacity picker without placing runtime Python in the narrow main CI exception. This PR adds the read-only picker and the shared GCP runner-group census support on feat-cmux-next. It accepts an exact online idle cmux-fleet-linux-x64 runner, waits at most three minutes for capacity, and selects measured Blacksmith Linux overflow when the fleet is unavailable. Explicit broker redispatch labels remain allowlisted, and a missing routing token falls back immediately.

The main wiring PR checks out these reviewed scripts into its admission picker. No source snapshot or test credential reaches the picker; only the routing App's read token is used.

Validation: fast-checks picker unit tests, runner census tests, Python compilation, and diff check.

Prior art read: #29932, #29934 and #30529; this is the runtime split required by the main CI exception.

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds a read-only fast-checks admission picker and extends runner census support to the approved GCP fleet group, so fast-checks can use verified fleet capacity without adding runtime Python to the main CI exception.

• Waits up to three minutes for an online, idle Linux fleet runner, then falls back to measured Blacksmith capacity; missing routing credentials trigger immediate fallback.
• Preserves allowlisted broker-selected Blacksmith labels and keeps source snapshots and test credentials out of the picker.
• Registers the picker's unit tests in the linux-guard lane.