#30283 ci(nightly): prefer reserved mini for secret-free signing checks

The secret-free signed-app verification and DMG-image jobs now consume the exact all-nightly M4 Pro reservation on same-repository NEXT attempt 1. The picker output prefers CI_NIGHTLY_ONLY_RUNNER=glaeda-nightly-only-m4pro, while malformed, unset, fork, other-track and retry contexts retain the existing owned-fleet and Blacksmith fallback.

This keeps release credentials, signing claims and temporary-keychain cleanup unchanged. The Linux ELF signer compiler and credentialed signer/notary jobs remain on the existing Linux picker; no release secret is routed to the reservation. The change is gated by the existing activation variable, which remains off until fleet registration and the exclusive claim hook are proven.

Leo asked: “For our nightlies, are they end to end on our fleet? We can't be relying on Blacksmith that cuts out.”

Validation:

• python3 tests/test_nightly_dedicated_mini.py </dev/null (8 passed)
• python3 tests/test_nightly_sign_runner.py </dev/null (46 passed)
• python3 tests/test_nightly_trusted_routing.py </dev/null (35 passed)
• python3 tests/test_ci_nightly_off_blacksmith.py </dev/null (20 passed)
• YAML parse and git diff --check pass.

Follow-up: preparation jobs are covered by #30113 and its dedicated-preference follow-up; credentialed signer Mac support still requires the per-job keychain/notary-profile design tracked in HQ research #5742.

Agent session: agent session
🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Makes the secret-free nightly verify and DMG-image jobs prefer the reserved glaeda-nightly-only-m4pro runner on same-repo nightly-next attempt 1.

• The picker uses the reservation only when CI_NIGHTLY_ONLY_RUNNER is exactly set; unset, stale, or foreign values fall through to the existing owned-fleet and Blacksmith selection.
• Release-pool signing jobs keep their runner and sign_owned contract, and no release secret routes to the reservation.
• Gated by CI_NIGHTLY_ONLY_RUNNER, which stays off until fleet registration and the exclusive claim hook are proven.
• Tests cover the reservation preference and fallback for forks, retries, other tracks, and invalid variable values.