#34201 nightly guards: the opt-in Cloud Tunnel step is covered, keyed and not legacy (base red)

Fixes two base reds on feat-cmux-next, both from 6b29137497e9 ("nightly: ship the opt-in Cloud Tunnel on a channel with a profile"), which added a Prepare the Cloud Tunnel extension step to nightly.yml and a CMUX_CLOUD_TUNNEL env on Build nightly app (Release):

• cmux-next guards / nightly-guards / workflow-guard-tests / release-notary
  • tests/test_nightly_universal_build.sh: FAIL: nightly still handles the legacy tunnel extension. The check greps the expanded workflow (step scripts inlined), and the new cloud-tunnel-prepare.sh mentions SystemExtensions. The check now skips that one step and still fails on tunnel handling anywhere else.
  • tests/test_nightly_step_coverage.py: the new step had no entry in .github/nightly-step-coverage.json. It is nightly_only (secret tunnel profile, signing entitlements).
• cmux-next / cmux-next checks (Script tests): tests/test_nightly_release_product_reuse.py test_skipped_steps_read_no_unkeyed_decide_output failed on notary_probe and profile_channel, which the Release build step now reads. notary_probe never reaches a product lookup (the lookup condition excludes it), and profile_channel is derived from notary_probe, track and channel (both keyed; '' on nightly-next), so neither can change a reused app without changing its key. Both are allowed, with a comment saying why. This red first showed at #33215 only because that was the first run of the job after the Cloud Tunnel series; #33215 does not touch these files.

Tests and a registry only; no workflow or Cloud Tunnel code changes. All three tests pass locally.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes three nightly guard failures on feat-cmux-next caused by the new "Prepare the Cloud Tunnel extension" step added to nightly.yml.

• Registers the step in .github/nightly-step-coverage.json as nightly_only.
• Skips that step in test_nightly_universal_build.sh so the legacy tunnel check still catches other tunnel handling.
• Allows notary_probe and profile_channel as unkeyed Release build inputs in test_nightly_release_product_reuse.py; they cannot change a reused app without changing its key.