#1739 runner-hook: a whole-mini claim names the hook that admitted the job

Leo, 2026-10-28: the release signing jobs may run on owned Macs, on a mini the job "claims exclusively".

The exclusive class's leftover-process check (#1738) only holds on minis whose runner dirs carry the new hook; a runner dir still on an older hook admits a signing job without it. This makes the claim name the hook that granted it, so cmux's signing jobs can refuse themselves (and fall back to Blacksmith in the same run) when an older hook admitted them.

• export_job_claim writes GLAEDA_HOOK_SHA256=<sha256 of this hook file> beside GLAEDA_JOB_CLAIM=exclusive.
• A hook that cannot read itself writes the claim without a sha, so a job that needs one refuses itself.
• Pins the hook's new sha256 (41e29cd9…) in glaeda-disk.

Before: $GITHUB_ENV gets GLAEDA_JOB_CLAIM=exclusive. After: it also gets GLAEDA_HOOK_SHA256=41e29cd9….

Tests: test_job_claim_names_only_a_whole_mini (both lines, and no sha for an unreadable hook) and test_a_signing_job_takes_the_whole_mini (an admitted signing job sees the sha) pass, as do the hook-pin and glaeda-disk hook tests.

Not in this PR: swapping a staged hook in at job start. It is left out on purpose.

Agent session: agent session

🤖 Generated with Claude Code