#30824 base red: release-notary green (helper admission gate, nightly.yml size, universal build pin, warm sources, promotion admission, highlight)

This PR fixes the last base reds in nightly-guards / workflow-guard-tests / release-notary (the follow-up to #30624). Lead decision, 12:06Z: fix them, and do not wait for the owners of #30284 and #30249.

Test	Cause	Culprit	Fix
test_nightly_ghostty_helper_cache.py	The lookup job got the early admission conjunct, and the helper build did not.	#30284	build-nightly-ghostty-cli-helper takes the same if: as resolve-nightly-ghostty-cli-helper (the job the owner changed on purpose). This changes nothing at run time: the helper needs the lookup and the resolver, which already had the clause, and it has no status function, so GitHub already skipped it with them. The clause makes that skip explicit, as the test requires.
test_nightly_workflow_size.py	nightly.yml was 508,735 bytes. The headroom is 508,000.	#30284 and the merges after it	The cache save steps repeated three R2 env values 6 times each. Each value is now an anchor on its first use and an alias on the other uses, as &pub-feeds, &pub-dmg and &pub-tooling already are. yaml.safe_load gives the same workflow, except for the helper if:. The file is now 505,604 bytes. No step is removed and no limit changes.
test_nightly_universal_build.sh	The test pinned the old helper runs-on and the old helper and resolver if:.	#30249, #30284	The pinned runs-on takes the merged route, because the merged workflow is the source of truth. The test names the admission conjunct (EARLY_ADMISSION). It checks that the resolver and the helper carry it as one conjunct, and that build-nightly-app keeps its gate. The build_only checks did not change.
test_ci_warm_sources.py	10 nightly.yml control jobs can now run on the dedicated nightly mini, and they had no entry. cmux-tui-spec.yml:clippy also had no entry.	#30249	Each control job takes mac-sign, which is the class of the other nightly.yml Mac jobs that compile nothing. Each has an exemption that says what the job does. clippy takes linux-rust with actions-cache, as its cmux-tui-spec peers do.
test_nightly_promotion_admission.py	The test counted nightly_next_train.py in the text. The two promote jobs now share their checkout through an anchor, so the text has only one copy.	#30471	The test reads the parsed workflow. It requires each of the two jobs that call guard.trainVerifier to check out the verifier. A mutation test confirms it: it fails when the path is removed from the anchor.
test_digest.py	The cloud-environment-editor highlight had no try-it action, docs link or pr link.	#30357	Added pr: #30357.

Why env anchors and not job or step anchors:

• test_nightly_signer_jobs.py refuses anchors on job-level keys, and runner_routing_table.py needs a one-line runs-on for hosted_light_jobs.
• Step aliases hide text that test_nightly_notices_submodule.py and test_nightly_promotion_admission.py count. I tried both, and both made new reds.

No new CI job, step or gate. Risk tier: python3 scripts/ci/risk_tier.py classify returns high, because nightly.yml is on the release path. This PR needs a SHIP receipt at the exact head and a green compile.

Red and green

"Red" is at base 9288e32f106 (the digest red at 265c68a569a). "Green" is at this head.

• python3 tests/test_nightly_ghostty_helper_cache.py: red failures=1, green OK.
• python3 tests/test_nightly_workflow_size.py: red "508735 not less than 508000", green OK.
• bash ./tests/test_nightly_universal_build.sh: red FAIL (helper runner pin), green PASS.
• python3 tests/test_ci_warm_sources.py: red with 11 jobs unlisted, green OK.
• python3 tests/test_nightly_promotion_admission.py: red AssertionError, green PASS (75 cases).
• python3 scripts/whats-new/test_digest.py: red failures=1, green OK.
• All 123 tests that read nightly.yml: the only result changes from base are these tests, which turn green.
• Every step of the release-notary group (110 steps, run locally): green. The arm64 step needs GITHUB_STEP_SUMMARY, which CI sets.
• With PATH=$HOME/.local/opt/git-2.47/bin:$PATH, tests/test_next_batch.py passes.

Observed / Not run

• Observed: every command above, plus prepush-gate.py.
• Still red, and not in this PR's scope: tests/test_workflow_file_size.py, in the preflight group. It caps nightly.yml at 490,000 bytes, and it was already red at base (508,735). This PR brings the file down to 505,604. Reaching 490,000 means moving run blocks into scripts/ci/nightly-steps/, which is a larger change.
• Not run: no app build. The workflow change is one job if: and three env anchors that parse to the same values.

Changelog

none