#31463 ci(nightly): keep the primary preparation off the light-job placement

Follow-up to #31410. It placed all three light jobs on the dedicated nightly Macs. The two small ones belong there. prepare-nightly-variant-primary doesn't: it downloads the whole unsigned app, scans every file for the browser-data import proof, and uploads the prepared app. On a dedicated nightly Mac that cost more than the 3-minute placement wait #31410 removed.

metric	before (Blacksmith route, run 41358657711)	with #31410 (dedicated Mac, run 41360732074)	after this PR	delta	harness
prepare-nightly-variant-primary duration	57 s	4 min 45 s (download 59 s, browser-data proof 99 s, upload 62 s)	about 57 s (Blacksmith route, no placement wait)	about -3.8 min against #31410	job and step timings
light-job placement	186 s	under 15 s	under 15 s	none	step timings

Change: the placement step's JOBS drops prepare-nightly-variant-primary, so it is never offered and its runs-on takes its Blacksmith route at once. Its placement-aware runs-on is unchanged.

Tests: tests/test_nightly_trusted_routing.py (updated), tests/test_ci_portable_job_placement.py, tests/test_ci_nightly_off_blacksmith.py and tests/test_runner_routing_table.py pass.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Keeps prepare-nightly-variant-primary off the dedicated nightly Mac placement so it takes its faster Blacksmith route.

#31410 put all three light jobs on dedicated nightly Macs. That made prepare-nightly-variant-primary take 4.8 min (download, browser-data import proof, upload) versus 57 s on its Blacksmith route, wiping out the 3-minute placement wait the placement removed. This PR drops it from the placement step's JOBS list — it's no longer offered, so it neither waits nor lands on a Mac — while the two small jobs stay on the reservation and its placement-aware runs-on is unchanged. Updated the placement test to match.