nightly: pick the signer on hosted Ubuntu instead of the saturated reservation
Moves pick-nightly-sign-runner off the all-nightly reservation. It now uses the allowlisted signer pick route from tests/test_ci_self_hosted_guard.sh: GitHub-hosted Ubuntu first, then the declared Linux 4 vCPU pool on a re-run.
The picker holds no signing key. It only chooses where sign-nightly-app runs. It sits on the path from tip to feed, though, and on the reservation it queued behind up to ~8 concurrent nightly builds.
This is the measured exception for light jobs that are not CPU-bound (signing and its runner pick), per the hosted-runner guard. sentry-dsyms-nightly and the DEV daily signer pick already use the same route. Signing itself is unchanged, and both notarizations stay.
Performance
| metric | before | after | delta | harness or run link |
|---|---|---|---|---|
| pick-nightly-sign-runner queue | 7-12 min (runs 41561996502: 12 min, 41563477649: 7.3 min) | hosted Ubuntu pickup, usually under 1 min | about -7 to -12 min per nightly | job timings of those runs |
| Blacksmith minutes/day | 0 for this job | 0 (re-run route is the fleet Linux 4 vCPU pool) | 0 |
Risk: low. One runs-on line, plus a test-list entry that records this job as a known non-fleet route.
Agent session: agent session
š¤ Generated with Claude Code
![Autofix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark-3x.png)
Open in [code]smith Ā· Need help on this PR? Tag @codesmith-bot with what you need.
Summary by cubic
Moves the nightly signer pick job off the all-nightly reservation so it no longer queues 7ā12 minutes behind the builds.
The picker holds no signing key; it only selects where sign-nightly-app runs. It now uses the allowlisted signer pick route: GitHub-hosted Ubuntu first, the declared Linux 4 vCPU pool on a re-run. sentry-dsyms-nightly and the DEV daily signer pick already use the same route. Signing itself and both notarizations are unchanged.