ci: run every job on the standard runners (cost stop until ci-spot) - #415

* ci: route CI Linux x64 jobs through the live ci-spot pool

* ci: route corpus parity through the ci-spot build class

* ci: route native live profiles through the ci-spot pool

* ci: route documentation through the public ci-spot class

* ci: route manual baseline promotion through ci-spot

* ci: route release Linux x64 jobs through ci-spot

* ci: require exact ci-spot routing and job labels in preflight

Replace the CR-170 standard-only runner contract with the public and engine-x64-16 fragments, including fork and untrusted-event fallback. Require one matching PF_CI_LABELS string at job scope; pin the Linux-only build and release matrix routing and the unchanged hosted legs. Retain larger-runner, timeout, core-count and reusable-workflow guards.

Update mutation and stage tests for missing, duplicate and incorrect PF_CI_LABELS, wrong label lists, unsafe fragment changes, paid labels and hosted exceptions. No tests, builds, linters or verification scripts run locally under the executor no-run rule.

* docs: record the live ci-spot pool and hosted fallbacks

Supersede the stopgap sentences from 3484a7c, squash-merged as 693fd9e (#415, CR-170). Reword the runner-selection and timing assumptions from d093560 (#290) and the documentation-only runner sentence from 133f571 (#308); preserve the platform limits from 2394ba2 (#373).

Record the 2026-10-18 live-pool bulletin, exact fragment and environment labels, class allocation, actor allowlist, hosted matrix legs and event fallbacks. Keep historical timings separate from unmeasured pool performance. No local verification run under the executor no-run rule.

* ci: restore release and deployment jobs to their original hosted runners

Apply the L6 production-credential ruling to Cloudflare docs deployment, baseline promotion and every release job. Restore all three workflow files byte-for-byte from origin/main, including their original hosted labels, and remove pool environment labels. No steps, permissions, timeouts or matrix populations change.

No tests, builds, linters, preflight, corpus verification or workflows run locally under the executor no-run rule. Nothing pushed.

* ci: adopt the b240f6d7 hosted fallback for pool jobs

Match the current pf-ci-spot public and engine-x64-16 fragments from bulletin #635. Change the hosted fallback to ubuntu-24.04 for all ten pool job definitions and preserve their matching PF_CI_LABELS, actor checks, fork protection and macOS routing.

No tests, builds, linters, preflight, corpus verification or workflows run locally under the executor no-run rule. Nothing pushed.

* ci: require hosted runners for credential-bearing jobs

Pin the b240f6d7 expressions and original hosted release/deployment routes. Detect non-GITHUB_TOKEN secrets, inherited workflow environment secrets, job or workflow OIDC write permissions and deployment environments. Require hosted routing without PF_CI_LABELS for credentials and current fragments with matching labels for other Linux x64 jobs. Preserve the larger-runner, timeout and core-count guards. Add must-fail credential and old-fallback cases and a must-pass case for the current hosted release workflow.

No tests, builds, linters, preflight, corpus verification or workflows run locally under the executor no-run rule. Nothing pushed.

* docs: record the L6 hosted credential rule and current pool fallback

Reword the pool-allocation, release/deploy routing and fallback sentences introduced by 28fe3466a and carried into f9bee22. Cite pf-ci-spot b240f6d7 and bulletin #635, retain the Dependabot and historical policy references, and explain the exact original hosted labels and updated preflight contract.

No tests, builds, linters, preflight, corpus verification or workflows run locally under the executor no-run rule. Nothing pushed.

* test(ci): anchor pool label mutations to job-level env

An unanchored four-space env search matched the tail of step-level env in promotion and release jobs, so the negative fixture never put PF_CI_LABELS in the job environment. Anchor the env and steps keys to complete job-level lines in both label fixture builders.

Assert the injected label at job scope and require the exact hosted-job diagnostic. Keep the existing hosted release baseline and the production guard unchanged. No tests, builds, linters or verification scripts run locally under the executor no-run rule. Nothing pushed.

Brings in the three CI-only commits that landed after the 1.6.1 final
(#415, #420, #439): workflows, docs/ci.md and ci_preflight. No file of this
branch's eight is touched by them; the merge is clean and changes none of the
EN-115 declaration, its tests or its prose. A merge commit on purpose: the
branch is pushed, so its history is not rewritten.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>