ci: light secret-free jobs to GitHub-hosted runners (owner R309/R312) - #512

… (CI-RUNNER-SPLIT, R309 + R312) (#514)

authz, changes and the aggregate `build` gate of ci.yml and ci-post.yml, the authz job of corpus-parity, corpus-parity-subset, docs, docs-post, native-live and release-ruleset-probe, and the docs build now run on `ubuntu-24.04`. The big jobs (preflight, build/sanitizer/kernel matrices, corpus parity, native-live) stay on the pf-gcp fleet, and the credentialed jobs (docs-post build, promote, release, notify-hub, probe) stay internal. Nothing else in the workflows changes.

scripts/ci_preflight.py pins exactly these jobs to the hosted image and still refuses a big or credentialed job on a hosted label and any unlisted label; its tests (including the probe workflow pin), docs/ci.md and the release-gate test's routing prose follow. Fork pull requests on hosted runners run without our secrets, so the VM-only fork-refusal hook is not needed for the moved jobs. Rollback is relabelling a job back to its pf-gcp label. AGENTS.md follows in its own docs PR.

docs/ci.md rewrites routing sentences that 3a0d150 (ci(cr233): split the PR wall from full-event verification, squash of #477) introduced, because the routing they describe changes with this PR: "No job chooses its label by event."; "`corpus-parity-subset.yml` is reusable only from the PR pipeline;"; "`corpus-parity.yml` keeps full parity and the full-event subset on the post fleet."; "The checker follows local reusable calls, so a PR caller cannot borrow a post workflow even behind a job condition."; "FLEET-POST=A (laneboss bulletin #1083, CR-233 ADD 2) supersedes the earlier non-release fleet policy."; "Each non-release workflow has one event class and one literal scheduler array, including authz, classification and aggregates:"; "The fleet is inferred from events and caller reachability, independently of workflow file names and job conditions."; "The command table pins job inventory and core-count usage, without assigning fleets by file name." The big and credentialed jobs keep the fleet routing those sentences described; only the named light jobs move to the hosted image.

Supersedes PR #512 (same change; its first commit lacked the 3a0d150 naming, which the doc-reverts check requires per commit and a later fix commit cannot supply; no force-push, so this is a new branch with the whole change in one commit).

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

…513)

* docs(agents): the CI routing paragraph names the hosted light jobs (companion to the runner split)

AGENTS.md lines 16-18 now say that the big jobs stay on the pf-gcp fleets, the secret-free light jobs (authz, changes, build gates, the docs build) run on the pinned hosted image ubuntu-24.04, and rollback is relabelling. Three lines replaced by three lines: the file keeps its 160 lines, so the content-hashed doc anchors do not move. Lands right after the runner split PR; until then the file describes the old routing.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci: run the light secret-free CI jobs on a pinned GitHub-hosted image (CI-RUNNER-SPLIT, R309 + R312) (#514)

authz, changes and the aggregate `build` gate of ci.yml and ci-post.yml, the authz job of corpus-parity, corpus-parity-subset, docs, docs-post, native-live and release-ruleset-probe, and the docs build now run on `ubuntu-24.04`. The big jobs (preflight, build/sanitizer/kernel matrices, corpus parity, native-live) stay on the pf-gcp fleet, and the credentialed jobs (docs-post build, promote, release, notify-hub, probe) stay internal. Nothing else in the workflows changes.

scripts/ci_preflight.py pins exactly these jobs to the hosted image and still refuses a big or credentialed job on a hosted label and any unlisted label; its tests (including the probe workflow pin), docs/ci.md and the release-gate test's routing prose follow. Fork pull requests on hosted runners run without our secrets, so the VM-only fork-refusal hook is not needed for the moved jobs. Rollback is relabelling a job back to its pf-gcp label. AGENTS.md follows in its own docs PR.

docs/ci.md rewrites routing sentences that 3a0d150 (ci(cr233): split the PR wall from full-event verification, squash of #477) introduced, because the routing they describe changes with this PR: "No job chooses its label by event."; "`corpus-parity-subset.yml` is reusable only from the PR pipeline;"; "`corpus-parity.yml` keeps full parity and the full-event subset on the post fleet."; "The checker follows local reusable calls, so a PR caller cannot borrow a post workflow even behind a job condition."; "FLEET-POST=A (laneboss bulletin #1083, CR-233 ADD 2) supersedes the earlier non-release fleet policy."; "Each non-release workflow has one event class and one literal scheduler array, including authz, classification and aggregates:"; "The fleet is inferred from events and caller reachability, independently of workflow file names and job conditions."; "The command table pins job inventory and core-count usage, without assigning fleets by file name." The big and credentialed jobs keep the fleet routing those sentences described; only the named light jobs move to the hosted image.

Supersedes PR #512 (same change; its first commit lacked the 3a0d150 naming, which the doc-reverts check requires per commit and a later fix commit cannot supply; no force-push, so this is a new branch with the whole change in one commit).

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: ci-cx <ci-cx@invalid>
Co-authored-by: Claude Sonnet 5.5 <[email protected]>