ci: run Linux x64 jobs on the pf-ci-spot pool - #420

Replace the CR-170 standard-only runner contract with the public and engine-x64-16 fragments, including fork and untrusted-event fallback. Require one matching PF_CI_LABELS string at job scope; pin the Linux-only build and release matrix routing and the unchanged hosted legs. Retain larger-runner, timeout, core-count and reusable-workflow guards.

Update mutation and stage tests for missing, duplicate and incorrect PF_CI_LABELS, wrong label lists, unsafe fragment changes, paid labels and hosted exceptions. No tests, builds, linters or verification scripts run locally under the executor no-run rule.

Supersede the stopgap sentences from 3484a7c, squash-merged as 693fd9e (#415, CR-170). Reword the runner-selection and timing assumptions from d093560 (#290) and the documentation-only runner sentence from 133f571 (#308); preserve the platform limits from 2394ba2 (#373).

Record the 2026-10-18 live-pool bulletin, exact fragment and environment labels, class allocation, actor allowlist, hosted matrix legs and event fallbacks. Keep historical timings separate from unmeasured pool performance. No local verification run under the executor no-run rule.

Apply the L6 production-credential ruling to Cloudflare docs deployment, baseline promotion and every release job. Restore all three workflow files byte-for-byte from origin/main, including their original hosted labels, and remove pool environment labels. No steps, permissions, timeouts or matrix populations change.

No tests, builds, linters, preflight, corpus verification or workflows run locally under the executor no-run rule. Nothing pushed.

Match the current pf-ci-spot public and engine-x64-16 fragments from bulletin #635. Change the hosted fallback to ubuntu-24.04 for all ten pool job definitions and preserve their matching PF_CI_LABELS, actor checks, fork protection and macOS routing.

No tests, builds, linters, preflight, corpus verification or workflows run locally under the executor no-run rule. Nothing pushed.

Pin the b240f6d7 expressions and original hosted release/deployment routes. Detect non-GITHUB_TOKEN secrets, inherited workflow environment secrets, job or workflow OIDC write permissions and deployment environments. Require hosted routing without PF_CI_LABELS for credentials and current fragments with matching labels for other Linux x64 jobs. Preserve the larger-runner, timeout and core-count guards. Add must-fail credential and old-fallback cases and a must-pass case for the current hosted release workflow.

No tests, builds, linters, preflight, corpus verification or workflows run locally under the executor no-run rule. Nothing pushed.

Reword the pool-allocation, release/deploy routing and fallback sentences introduced by 28fe3466a and carried into f9bee22. Cite pf-ci-spot b240f6d7 and bulletin #635, retain the Dependabot and historical policy references, and explain the exact original hosted labels and updated preflight contract.

No tests, builds, linters, preflight, corpus verification or workflows run locally under the executor no-run rule. Nothing pushed.

An unanchored four-space env search matched the tail of step-level env in promotion and release jobs, so the negative fixture never put PF_CI_LABELS in the job environment. Anchor the env and steps keys to complete job-level lines in both label fixture builders.

Assert the injected label at job scope and require the exact hosted-job diagnostic. Keep the existing hosted release baseline and the production guard unchanged. No tests, builds, linters or verification scripts run locally under the executor no-run rule. Nothing pushed.