ci: use the reconciled runner pool for fast gates
The next-autoland fast-gates workflow could queue indefinitely on its literal fleet Linux label while the runner-pool reconciler had already moved the live route to another declared member. That left cmux-next/fast-gates stale and forced manual landings.
This changes the four trusted fast-gates jobs (resolve, fast-gates, panic-ratchet, and post) to read fromJSON(vars.RUNNER_POOLS).linux as their default. Fork pull requests keep their read-only hosted/Blacksmith route, and an explicitly supplied runner remains limited to the existing allowlist. The workflow test asserts every job uses the reconciled pool and no terminal literal fleet fallback remains.
Leo said, “If you don't merge changes like that within the day there'd better be an extremely good reason,” and “within three hours if needs changes / within the hour if straightforward.”
The existing PR-only cancel-in-progress: true group stays: a recovery dispatch replaces the queued run. Started nightly, DEV and promote workflows are outside this workflow. Existing runner-pool stall evidence and queued-only rescue provide failover; this change adds no scheduler, secret or permission. The light-hosted declaration is separate because the shared pool policy is on main.
Validation: static prepush checks pass. Focused fast-gates tests and tests/test_ci_self_hosted_guard.sh will run through cmux-ci at the PR head.
Performance estimates for the routing-only delta (same workload, with 100 overflowed workflows/day as an illustrative bound):
| Metric | Before | After | Delta | Basis |
|---|---|---|---|---|
| Added picker jobs / day | 0 | 0 | 0 | Existing reconciled pool is reused |
| Hosted Linux minutes / day | 0 | 0 | 0 | No new hosted route |
| Blacksmith control minutes / day, outage scenario | 0 while stranded | about 100 | about +100 | Estimate: 100 workflows × two light steps × 0.5 minute; replaces no-start queues |
| Blacksmith control minutes / day, fleet healthy | 0 | 0 | 0 | Fleet remains first in the declared pool |
Heavy test minutes depend on routed changes and are the same work already requested; no duplicate run or extra build is added. This is control-job routing, so there is no compile cache or DerivedData change.
Agent session: agent session
🤖 Generated with Claude Code
![View with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v3-3x.png)
![Autofix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark-3x.png)
Need help on this PR? Tag @codesmith-bot with what you need.
Summary by cubic
Updates the cmux-next/fast-gates workflow so the four trusted jobs (resolve, fast-gates, panic-ratchet, post) default to the reconciled runner pool (fromJSON(vars.RUNNER_POOLS).linux) instead of the literal cmux-fleet-linux-x64 label, which could stall when the runner-pool reconciler moved the live route.
- Fork pull requests keep their hosted/Blacksmith route, and
panic-ratchetnow routes fork jobs via Blacksmith so fork PRs never read repository variables. - An explicitly supplied runner remains limited to the existing allowlist.
- The workflow test now asserts every job's default runner resolves to the reconciled pool, except
panic-ratchetwhose optional fork route is unchanged.