docs: document dogfood download trust and public exposure

[azooz2003-bit]

The dogfood download path did not document its authorization checks or that signed links are visible on public PRs. Add the request steps, every publisher gate, the secret-holding job boundary, SHA-256 write-once uploads, and 15-minute public exposure together with the #17220 argument-size repair.

Validation: checked every statement against main's CI producer and publisher, self-reviewed the documentation-only diff, ran git diff --check, and verified the relative workflow link. scripts/localize-changes --base upstream/main found zero changed macOS or web keys; its strict validator reports 24 pre-existing parity errors in the unchanged machines.new.plan.{loading,retry,error} entries.

— Cipherleaf g1 🧩
Run: run_dogfood_publisher_docs_20261004T0232Z
Session: codex-root-dogfood-docs-20261004
Intention: document dogfood artifact publication.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Documents the previously undocumented dogfood app download path in docs/ci-runners.md, covering how to request a link, all publisher authorization gates, the secret-holding job boundary, SHA-256 write-once uploads, and the 15-minute public exposure of signed links on public PRs. Also notes the #17220 fix for argument-list-too-long failures before trust checks could run.

^{Written for commit 63d15b3. Summary will update on new commits.}

Summary by CodeRabbit

• Documentation
  • Added guidance for requesting downloadable Dogfood builds from eligible pull requests.
  • Clarified that links are published only when the pull request meets the eligibility requirements and has a successful build for its current revision.
  • Explained that download links are temporary and can be accessed by anyone who can read the pull request comment while the link is valid.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 53 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 673f0c44-4166-43a2-a91b-da3f7d1c1338

📥 Commits

Reviewing files that changed from the base of the PR and between a8c4861 and 63d15b3.

📒 Files selected for processing (1)

• docs/ci-runners.md

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Note

Pull Request opener @azooz2003-bit is not an author or co-author of any commit in this PR (commit identities: teamleaderleo). The CLA check will still proceed and requires every listed identity plus @azooz2003-bit to have signed.

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}