[AnthonyRonning]

Restore the four previously upgraded heavy unsigned Apple job definitions on blacksmith-6vcpu-macos-26: Research universal and Dev desktop, iOS simulator, and Agent Dev/Prod binary compilation (five expanded builds). Move the billing-blocked Agent prebuilt signer to standard GitHub macos-26; preview assembly also stays on standard GitHub. Both packagers consume an already compiled binary, so neither needs the paid larger runner. Existing standard checks, TestFlight upload and release builders retain their labels.

The Agent binary build runs on PRs and master, references no signing secrets or protected environment, and feeds the existing protected GitHub signer. Its master-only condition, desktop-signing, credential scope/cleanup, mandatory attestation and --deny-self-hosted-runners verification remain unchanged. Final signed-package provenance identifies the GitHub packaging/signing job; Blacksmith is trusted for prebuilt binary integrity. Exact Xcode 26.5/build 17F42, ONNX hashes, deployment targets, cache scopes and publication triggers are preserved.

All seven initial unsigned Mac trial instances passed on ccbd68f. All five provider compilers and both standard-GitHub preview packagers also passed at ff400b15; their application/toolchain inputs are unchanged by the final signer-label-only change. The temporary toolchain probe has been removed. Timings exclude queue and compare against dated working upgraded-runner samples with different source/cache states:

Workload	Initial Blacksmith 6 CPU trial	Final unsigned validation	Previous GitHub xlarge
Research universal desktop	19m02s	Blacksmith: 9m58s	25m16s
Research Dev desktop	7m02s	Blacksmith: 5m19s	10m16s
iOS simulator/ONNX	16m24s	Blacksmith: 6m18s	21m39s
Agent binary Dev	19m07s	Blacksmith: 18m08s	22m13s
Agent binary Prod	18m27s	Blacksmith: 18m18s	25m16s
Agent unsigned packaging Dev	2m52s	Standard GitHub: 4m06s	2m57s
Agent unsigned packaging Prod	2m45s	Standard GitHub: 5m14s	3m08s

Final unsigned Research jobs restored archive caches; the separate universal sccache statistics step reports zero requests, so a compiler hit-rate claim is unsupported. Agent optimized builds used cold Rust dependency caches. The original five compiler trials peaked at 12.6–13.9GB and all reached 100% CPU at P90; six CPUs and 24GiB were observed on the provider.

Validation: final local nix flake check --no-update-lock-file --print-build-logs, actionlint and all 432 CI-script hook tests passed. Independent review found no issues in the signer-label-only delta. Existing iOS device/simulator ONNX archive pins matched. Independently downloaded Research Dev identity, executable hash, ARM64 architecture, scheme and macOS 13.4 minimum matched its profile. Both final standard-GitHub Agent preview packages passed profile/source/hash/ad-hoc-signature checks and their existing GUI rendering smoke. No local app runtime was exercised. The protected signed/notarized job runs only on master and has not been executed by this PR; Apple credentials remain on GitHub. Signing, notarization and TestFlight publication on Blacksmith are outside this change.

Final unsigned evidence: desktop, iOS, Agent. Initial trials: desktop, iOS, Agent, exact-toolchain probe.