ci: make owned-pool rescue side-lane sweeper-only

.github/workflows/ci-owned-pool-rescue.yml

@@ -32,19 +32,14 @@ run-name: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow
 # - ios-screenshots.yml: release.yml calls it with only `contents: read`, so a
 #   job there asking for Actions write would fail the release at parse time
 #   (#12149). Its direct dispatches are rare (no run from 2026-09-23 to 09-25).
-# - The side lanes (app-host-test-rerun, auth-refresh-tests,
-#   cloud-command-deadlines, cloud-machine-tests, cloud-task-local-tests,
-#   cmux-tui, iroh-v2, relay-tls, reload-build, remote-daemon,
-#   terminal-hang-diagnostics)
-#   have no picker: while vars.CI_SIDE_LANE_RUNNER names a glaeda-side-*
-#   label, every trusted attempt-1 run of theirs (a same-repository pull
-#   request, a push, a schedule or a workflow_dispatch) is on the fleet, so a
-#   dispatch would save no run.
 # - nightly.yml: build-nightly-app has no picker either. While
 #   vars.CI_SEED_TRUSTED_POOL names a glaeda-trusted-* pool and
 #   vars.CI_NIGHTLY_TRUSTED_RUNNER a glaeda-runner-* label, attempt 1 of every
 #   push or schedule run on main asks for that one trusted mini, so every such
 #   run is watched (owned_pool_rescue.NIGHTLY_WORKFLOW_PATH).
+# The side lanes have no picker and are already covered by the periodic
+# sweeper. They stay in the script's target rules for explicit dispatches, but
+# no longer wake a fresh rescue through workflow_run.
 # It needs actions: write, and its code comes from main. It runs whenever
 # owned pools are on (CI_PR_POOL_OWNED is 1), because a run on an owned pool
 # has no other way off it; CI_OWNED_POOL_RESCUE=0 turns it off. The switch
@@ -57,19 +52,6 @@ on:
   workflow_run:
     workflows:
       - iOS App Store screenshots
-      # Side lanes (owned_pool_rescue.SIDE_WORKFLOW_PATHS): watched only while
-      # vars.CI_SIDE_LANE_RUNNER routes them to the fleet.
-      - App-host test rerun
-      - Auth and session lifecycle
-      - Cloud command deadlines
-      - Cloud machine lifecycle
-      - Cloud task-local lifecycle
-      - cmux-tui
-      - IROH v2
-      - Relay TLS system trust
-      - reload-build
-      - SSH remote daemon
-      - Terminal hang diagnostics
       # nightly.yml: its app build takes the trusted owned pool on attempt 1
       # of main's push and schedule runs (owned_pool_rescue.NIGHTLY_WORKFLOW_PATH).
       - Nightly macOS build
@@ -100,13 +82,6 @@ env:
   # this path. The script confirms the run's own `path` again before acting.
   SOURCE_WORKFLOW_PATHS: >-
     .github/workflows/ios-screenshots.yml
-    .github/workflows/app-host-test-rerun.yml
-    .github/workflows/auth-refresh-tests.yml .github/workflows/cloud-command-deadlines.yml
-    .github/workflows/cloud-machine-tests.yml .github/workflows/cloud-task-local-tests.yml
-    .github/workflows/cmux-tui.yml
-    .github/workflows/iroh-v2.yml .github/workflows/relay-tls.yml
-    .github/workflows/reload-build.yml .github/workflows/remote-daemon.yml
-    .github/workflows/terminal-hang-diagnostics.yml
     .github/workflows/nightly.yml
 
 concurrency:

tests/test_ci_owned_pool_rescue.py

@@ -1784,19 +1784,25 @@ def test_default_branch_code_with_actions_write_only_in_the_job(self):
         checkout = job["steps"][0]
         self.assertEqual(checkout["with"], {"ref": "main", "persist-credentials": False})
 
-    def test_runs_when_dispatched_or_for_a_screenshots_or_side_lane_run(self):
+    def test_runs_when_dispatched_or_for_a_screenshots_or_nightly_run(self):
         triggers = self.doc[True]
         self.assertEqual(sorted(triggers), ["schedule", "workflow_dispatch", "workflow_run"])
         self.assertIs(triggers["workflow_dispatch"]["inputs"]["run_id"]["required"], False)
         # release.yml calls ios-screenshots.yml with contents: read only, so
-        # it cannot upload through a job asking for more; the side lanes have
-        # no picker and are all on the fleet. Both keep the event trigger.
+        # it cannot upload through a job asking for more. Side lanes are swept
+        # periodically and must not create one rescue run per workflow_run.
         self.assertEqual(triggers["workflow_run"]["types"], ["requested"])
-        self.assertEqual(triggers["workflow_run"]["workflows"][0], "iOS App Store screenshots")
+        self.assertEqual(
+            triggers["workflow_run"]["workflows"],
+            ["iOS App Store screenshots", "Nightly macOS build"],
+        )
         self.assertNotIn("CI", triggers["workflow_run"]["workflows"])
         paths = self.doc["env"]["SOURCE_WORKFLOW_PATHS"].split()
-        self.assertEqual(set(paths), {rescue.IOS_SCREENSHOTS_WORKFLOW_PATH, *rescue.SIDE_WORKFLOW_PATHS,
-                                      rescue.NIGHTLY_WORKFLOW_PATH})
+        self.assertEqual(
+            set(paths),
+            {rescue.IOS_SCREENSHOTS_WORKFLOW_PATH, rescue.NIGHTLY_WORKFLOW_PATH},
+        )
+        self.assertTrue(set(paths).isdisjoint(rescue.SIDE_WORKFLOW_PATHS))
         # workflow_run matches by display name: each source's `name:` is listed, and nothing else.
         names = {yaml.safe_load((ROOT / path).read_text(encoding="utf-8"))["name"] for path in paths}
         self.assertEqual(set(triggers["workflow_run"]["workflows"]), names)