#30761 ci: keep backend credentials on bounded ephemeral Linux routes

The Linux pool is becoming fleet-first, so credentialed backend jobs must retain their existing ephemeral-runner boundary. Follow-up to #30685: 11 jobs now accept only the measured Blacksmith Linux members through the legacy mirror. The secretless migration guard keeps its fleet-capable pool route.

Leo: “FOR OUR NIGHTLIES ARE THEY END TO END ON OUR FLEET? WE CAN'T BE RELYING ON BLACKSMITH THAT CUTS OUT.” This preserves the existing secret and runner-trust boundary while enabling that migration.

The scheduled writer's existing integration test now covers every backend job with secrets or an environment and rejects a newly added credentialed job missing from the boundary. It also verifies that the secretless guard retains its pool route. Workflow environments, secrets, permissions and deployment behavior are unchanged.

Validation: 22 integration tests pass against the actual main policy checkout, including all backend boundaries; workflow YAML and diff checks pass. No compile or cache change. Prior art: #30685, #30360, #30714.

Performance	Before	After	Evidence
Blacksmith minutes/day	Not measured	Not measured	Trust-boundary fix; no unsupported usage estimate

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Keeps credentialed backend jobs on a bounded set of ephemeral Linux runners instead of the fleet-capable pool route, preserving the existing secret and runner-trust boundary while the Linux pool becomes fleet-first.

• Switches 11 credentialed backend jobs (vitess, migrations, preview, deploys, promotions, rollback, chief-off, cleanup) to pin runs-on to the ephemeral blacksmith-4vcpu/8vcpu/16vcpu-ubuntu-2404 mirror via vars.LINUX_RUNNER, defaulting to blacksmith-8vcpu-ubuntu-2404; PRs from forks keep ubuntu-24.04.
• Leaves the secretless migrations-push-guard on the fleet-capable RUNNER_POOLS.linux route.
• Extends the runner-pool reconcile tests to assert all credentialed backend jobs use only the ephemeral mirror and to fail when a new credentialed job is missing from the boundary.
• Adds backend.yml to the ci-fast-guards sparse checkout so those tests validate the actual workflow.