#30867 base red: owned pool sources accepts feat-cmux-next's own unrescued list

Base red fix. Since cmux#30685, tests/test_ci_owned_pool_sources.py has failed on feat-cmux-next with .github/workflows/backend.yml: job migrations-push-guard reads vars.RUNNER_POOLS. #30761 kept that read on purpose. The test only accepts the acknowledgement from main's copy of scripts/ci/owned_pool_rescue.py, and main takes no merges right now, so #30840 can't land.

Change:

• feat-cmux-next's rescue copy gets UNRESCUED_WORKFLOW_PATHS with backend.yml and the reason: no secret, a live pool member, and a stuck run is cleared by its timeout or a cancel.
• On feat-cmux-next, the test accepts an unrescued entry from either copy.
• Watched paths still come only from main's copy, the one the workflow_run runs. An unrescued entry changes no behaviour, since the rescue acts only on watched paths, so the test's intent holds.

Tests: with CMUX_OWNED_POOL_BRANCH=feat-cmux-next, test_ci_owned_pool_sources fails on base ae2f00e8 and passes here (7 tests, none skipped). test_ci_owned_pool_rescue passes.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the test_ci_owned_pool_sources failure on feat-cmux-next, red since cmux#30685 made backend.yml's migrations-push-guard read vars.RUNNER_POOLS while main takes no merges to carry the acknowledgement.

• Adds UNRESCUED_WORKFLOW_PATHS with backend.yml to the branch's rescue copy: no secret, a live pool member, and a stuck run is cleared by its timeout or a cancel.
• On feat-cmux-next, the test accepts an unrescued entry from either the branch's or main's rescue copy.
• Watched paths still come from main's copy, so the unrescued entry changes no rescue behavior.