[AnthonyRonning]

Linux and Android signed compilation still requests billing-blocked GitHub larger runners, while unsigned Research and Agent builds were downgraded to standard runners. Move those compile-heavy Linux jobs to blacksmith-8vcpu-ubuntu-2404 (8 vCPU, 32 GB RAM, 160 GB disk), preserving pinned Nix environments and build scripts. Restore lightweight artifact verification and the web release build to standard GitHub runners. Windows and macOS runner placement is unchanged.

Unsigned trials at c01924af all passed:

Job	Blacksmith 8 CPU	Original GitHub 8 CPU
Research Linux packages	17m57s	25m17s
Android fake-signed APK/AAB	16m47s	24m37s
Agent CI feature matrix and release binary	26m03s	35m37s
Agent Dev AppImage	16m25s	21m25s
Agent Prod AppImage	17m23s	21m37s

Both downloaded Agent AppImages independently passed profile/hash verification and network-disabled launch without Nix. Peak vendor memory was 5,413 MB for Research Linux and 9,768 MB for Agent CI; their busiest CPU phases reached 99–100% utilization.

Original 8-core PR baselines are from 5a42cdb6: Agent source, SDK/proxy, frozen versions, Nix definitions, and build scripts match; four Research frontend files differ. Rust/sccache caches missed in both samples (original Android Bun cache hit). These separate runs include network/substitution and runner variation, so they are observations rather than controlled benchmarks. Rebasing onto merged EIF #1118, Windows #1120 and Mac #1119 changes no Linux application build input or Linux job configuration; the duplicate Windows verifier hunks drop from this PR. Blacksmith's $0.004/min base price, with fourfold 8 CPU normalization, gives $0.016/min, versus $0.022/min for the original GitHub 8 CPU Linux runner, before allowances and storage.

Signing environments, release classification, separate GitHub Agent attestation, Dev/Prod profiles, and publication controls are preserved. This adds provider trust for protected signing jobs: desktop-signing has eight updater/Apple/keychain secrets and android-signing has three keystore/alias/password secrets. The Apple guard only empties the Linux build subprocess variables; it does not isolate those secrets from the runner's job context. Fresh metadata shows zero repository or inherited organization Actions secrets, distinguishing these future protected jobs from the unsigned trials. No secret values were accessed, and no protected signing, publication, or deployment was dispatched.

Local validation: nix flake check --no-update-lock-file passed all 11 applicable aarch64-darwin checks, including actionlint, selection, signing boundaries, Agent workflows, and release gates. The commit hook passed all 433 repository tests; git diff --check passed. Rebased head b914c5d6 also passed Repository CI, release gates, all five Linux targets, and both downloaded AppImage verifiers. Its refreshed durations were Research 12m46s, Android 9m16s, Agent CI 26m04s, Agent Dev 17m05s, and Agent Prod 15m49s; Research/Android cache archives restored, so the initial cold timings above remain the comparison. Unchanged GitHub macOS/Windows rows are tracked separately.

Final integration head 44aa9072 is based on master 5bf9e596 with all four Blacksmith labels registered. It passed the full 433-test hook, actionlint and all 11 applicable local flake checks. Structured comparison confirms the tested b914c5d6 native source/locks/Nix/build-script tree and each Linux job configuration are identical; its green native trials remain the build evidence. Independent final source review found no actionable issue. Fresh final-head Repository CI and release gates both passed.