#35735 ci(nightly): republished nightly-next builds follow their source's CEF pack and source archive; report a failed fetch

Follow-ups F1 to F3 from the review of #35588 (receipt at b1d50f52), which added the republish path for a verified nightly-next build. This is item 2 of cmuxterm-hq#7061, "Republish with tip tooling".

F1, Chromium runtime pack. publish-nightly's "Select the build to publish" step now outputs cef, and both CEF steps gate on it instead of on vars.CMUX_NEXT_CEF_ON_DEMAND. Own and notarization-recovered builds still follow the switch. A republished build follows its source run: republish-nightly-next outputs cef, which is true when the source's signer uploaded cef-runtime-pack, the same condition under which the app was signed with an on-demand pin. Flipping the switch after the build therefore neither drops a pack the app needs nor fails on a pack the source never made.

F2, source archive. The cmux-next-source-archive artifact always carries the license trees. The tarball is in it only while CMUX_NEXT_PUBLISH_SOURCE_ARCHIVE was 1. republish-verified-nightly.py now outputs source_archive, true when exactly one cmux-next-source-*.tar.gz was restored. publish-nightly outputs source_archive: the switch, and for a republished build also that tarball. All three source-archive steps in publish-nightly-next-github gate on it. A republish of a source with no tarball now publishes no archive, instead of failing at mv nightly-out/source-archive after the feed was written. The variable stays the switch, and own and recovered builds behave as before.

F3, failure reporting. republish-nightly-next is now in report-nightly-failure's needs, so a failed fetch, which leaves publish-nightly skipped, opens the nightly failure issue. Its if already reports any failed need.

Tests

• tests/test_nightly_next_recovery.py: 78 pass, 4 of them new (pack and archive per switch and source, the tarball check, and a failed fetch reporting).
• Every other tests/test_nightly*.py, tests/test_ci_nightly*.py and tests/test_nightly_universal_build.sh passes, except test_nightly_next_arm64_only.py and test_nightly_owned_minis_only.py. Those two (OwnedWorkdirSteps) also fail at base 3e464b08ff9.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Makes republished nightly-next builds match the build they republish: they now carry the same Chromium runtime pack and source archive, and a failed republish fetch opens the nightly failure issue.

• A republished build publishes the Chromium runtime pack its source run signed with, instead of following the current CMUX_NEXT_CEF_ON_DEMAND switch.
• With no source tarball, a republished build publishes no source archive instead of failing after the feed was written; the CMUX_NEXT_PUBLISH_SOURCE_ARCHIVE switch still gates own and recovered builds.
• republish-nightly-next is now a dependency of report-nightly-failure, so failed fetches produce the nightly failure issue.