#32529 ci(nightly): clear the release-notary guard reds (warm sources, universal nightly workflow)

Base red: cmux-next guards / nightly-guards / workflow-guard-tests / release-notary fails on feat-cmux-next (for example run 41504624858) and on four open PRs. Two steps fail.

• Validate nightly push throttle, tests/test_ci_warm_sources.py:
  • Cause: #32513 moved "Build and sign the release notes" into scripts/ci/nightly-steps/release-notes-build-sign.sh. The warm-sources detector treats any script named *build*.sh as a compile, so sign-release-notes became a compile job with no warm sources.
  • Fix: the step compiles nothing, so the script is renamed release-notes-sign.sh. The rule itself is unchanged.
• Validate universal nightly workflow, tests/test_nightly_universal_build.sh:
  • Cause: #32457 turned literal runner labels into declared pool reads (fromJSON(vars.RUNNER_POOLS).<pool>, whose first member is the old literal). Three of this script's exact-expression checks still expected the literals: the decide gate, refresh-compilation-cache and build-nightly-ghostty-cli-helper. The script exits at its first FAIL, so the later two only surfaced after the first was fixed.
  • Fix: the three checks now expect the pool reads #32457 wrote. Each still matches the job's whole runs-on expression, not a prefix. I checked the updated helper expectation against the expanded workflow.

Locally, every command in both steps passes: test_nightly_universal_build.sh, test_nightly_trusted_routing, test_nightly_build_state, test_ensure_setup_node, and the nine tests in the push throttle step (warm sources included). test_workflow_file_size, test_nightly_step_coverage and test_nightly_next_identity pass too.

Base-red-job: cmux-next guards / nightly-guards / workflow-guard-tests / release-notary

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Clears the release-notary nightly-guard reds by updating two tests that broke after recent workflow changes.

• Renames release-notes-build-sign.sh to release-notes-sign.sh; the warm-sources detector treats any script named *build*.sh as a compile, but this step compiles nothing.
• test_nightly_universal_build.sh now expects the fromJSON(vars.RUNNER_POOLS) pool reads for the decide gate, refresh-compilation-cache, and build-nightly-ghostty-cli-helper, matching the expressions #32457 wrote.