ci(infra-3596): provider-aware runs-on for signed iOS / TestFlight upload

Adds runner_provider plumbing to upload-to-testflight.yml and
build-and-upload-to-testflight.yml so signed iOS builds + TestFlight
upload can be dispatched on Namespace runners on the trial path.

upload-to-testflight.yml:
- Add runner_provider input to workflow_call
- testflight-upload-summary (ubuntu-latest) -> namespace-profile-metamask-ci-linux
- upload-ios-testflight (cirruslabs macos-runner:tahoe-xl) -> namespace-profile-metamask-ios-build

build-and-upload-to-testflight.yml:
- Add runner_provider input to workflow_call and workflow_dispatch
- Forward runner_provider to build.yml (already accepts the input)
- Forward runner_provider to upload-to-testflight.yml
- cleanup-build-branch (ubuntu-latest) -> namespace-profile-metamask-ci-linux
- create-build-branch.yml call left unchanged: tiny ephemeral
  branch-creation job, not in the Phase 4 ticket inventory

Per the ticket's parallel work item, keychain cleanup must be validated
when this is dispatched on Namespace to ensure signing certificates
don't leak between jobs on the persistent macOS runner storage. The
existing configure-signing composite action handles cleanup; the trial
dispatch will exercise it on the new infrastructure.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: XxdpavelxX

.github/workflows/build-and-upload-to-testflight.yml

@@ -19,6 +19,11 @@ on:
         required: false
         type: string
         default: 'MetaMask BETA & Release Candidates'
+      runner_provider:
+        description: Runner provider forwarded from the caller
+        required: false
+        type: string
+        default: current
   workflow_dispatch:
     inputs:
       source_branch:
@@ -44,6 +49,14 @@ on:
           - 'MetaMask BETA & Release Candidates'
           - 'MM Card Team'
           - 'Ramp Provider Testing'
+      runner_provider:
+        description: Runner provider for this manual trial run
+        required: false
+        type: choice
+        options:
+          - current
+          - namespace
+        default: current
 
 permissions:
   contents: write
@@ -65,6 +78,7 @@ jobs:
       platform: ios
       skip_version_bump: false
       source_branch: ${{ needs.prepare-build-branch.outputs.build_branch }}
+      runner_provider: ${{ inputs.runner_provider }}
     secrets: inherit
 
   upload-ios-testflight:
@@ -79,13 +93,14 @@ jobs:
       build_commit_sha: ${{ needs.build.outputs.built_commit_sha }}
       build_version: ${{ needs.build.outputs.semantic_version }}
       build_number: ${{ needs.build.outputs.ios_version_code }}
+      runner_provider: ${{ inputs.runner_provider }}
     secrets: inherit
 
   cleanup-build-branch:
     name: Cleanup build branch
     needs: [prepare-build-branch, upload-ios-testflight]
     if: always()
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/upload-to-testflight.yml

@@ -39,6 +39,11 @@ on:
         description: 'The build number of the app (eg. 4134)'
         required: true
         type: string
+      runner_provider:
+        description: Runner provider forwarded from the caller
+        required: false
+        type: string
+        default: current
 
 permissions:
   contents: read
@@ -47,7 +52,7 @@ permissions:
 jobs:
   testflight-upload-summary:
     name: TestFlight upload summary
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
     steps:
       - name: Display TestFlight upload summary
         run: |
@@ -69,7 +74,7 @@ jobs:
   upload-ios-testflight:
     name: Upload iOS to TestFlight
     needs: [testflight-upload-summary]
-    runs-on: ghcr.io/cirruslabs/macos-runner:tahoe-xl
+    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ios-build' || 'ghcr.io/cirruslabs/macos-runner:tahoe-xl' }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4