ci: light secret-free jobs to GitHub-hosted runners (owner R309/R312) - #514

Brings in the runner split (#514). First parent is main; no change to this PR's own file, AGENTS.md (3 lines replaced by 3 lines, 160 lines before and after).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…513)

* docs(agents): the CI routing paragraph names the hosted light jobs (companion to the runner split)

AGENTS.md lines 16-18 now say that the big jobs stay on the pf-gcp fleets, the secret-free light jobs (authz, changes, build gates, the docs build) run on the pinned hosted image ubuntu-24.04, and rollback is relabelling. Three lines replaced by three lines: the file keeps its 160 lines, so the content-hashed doc anchors do not move. Lands right after the runner split PR; until then the file describes the old routing.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci: run the light secret-free CI jobs on a pinned GitHub-hosted image (CI-RUNNER-SPLIT, R309 + R312) (#514)

authz, changes and the aggregate `build` gate of ci.yml and ci-post.yml, the authz job of corpus-parity, corpus-parity-subset, docs, docs-post, native-live and release-ruleset-probe, and the docs build now run on `ubuntu-24.04`. The big jobs (preflight, build/sanitizer/kernel matrices, corpus parity, native-live) stay on the pf-gcp fleet, and the credentialed jobs (docs-post build, promote, release, notify-hub, probe) stay internal. Nothing else in the workflows changes.

scripts/ci_preflight.py pins exactly these jobs to the hosted image and still refuses a big or credentialed job on a hosted label and any unlisted label; its tests (including the probe workflow pin), docs/ci.md and the release-gate test's routing prose follow. Fork pull requests on hosted runners run without our secrets, so the VM-only fork-refusal hook is not needed for the moved jobs. Rollback is relabelling a job back to its pf-gcp label. AGENTS.md follows in its own docs PR.

docs/ci.md rewrites routing sentences that 3a0d150 (ci(cr233): split the PR wall from full-event verification, squash of #477) introduced, because the routing they describe changes with this PR: "No job chooses its label by event."; "`corpus-parity-subset.yml` is reusable only from the PR pipeline;"; "`corpus-parity.yml` keeps full parity and the full-event subset on the post fleet."; "The checker follows local reusable calls, so a PR caller cannot borrow a post workflow even behind a job condition."; "FLEET-POST=A (laneboss bulletin #1083, CR-233 ADD 2) supersedes the earlier non-release fleet policy."; "Each non-release workflow has one event class and one literal scheduler array, including authz, classification and aggregates:"; "The fleet is inferred from events and caller reachability, independently of workflow file names and job conditions."; "The command table pins job inventory and core-count usage, without assigning fleets by file name." The big and credentialed jobs keep the fleet routing those sentences described; only the named light jobs move to the hosted image.

Supersedes PR #512 (same change; its first commit lacked the 3a0d150 naming, which the doc-reverts check requires per commit and a later fix commit cannot supply; no force-push, so this is a new branch with the whole change in one commit).

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: ci-cx <ci-cx@invalid>
Co-authored-by: Claude Sonnet 5.5 <[email protected]>

## What

Adds the `## 1.8.0 — 2026-10-27` section (with migration notes) to `CHANGELOG.md`, above `## 1.7.0`. `CHANGELOG.md` is the only file changed (+131/-0). Documentation only: no `src/`, `include/`, `docker/`, `scripts/`, `tests/` or workflow file is touched.

## Why

The engine release body is generated from git-log subjects only and carries no migration notes; the release notes users read are this file (and the GitHub release body edited from it after publish). The notes must be on main before the release dispatch.

## Content

- Compatibility and migration: exact pairing with codegen 1.8.0, regenerate C++ and relink every strategy library, no public header change, the new codegen `color` input type, the changed harness file `docker/run_json.py`.
- Faster `run_json` report handling (#517) with the measured table against 1.6.3 and 1.7.0 and the statement that the gap to 1.6.3 is not closed.
- Scratch placement restated (#518); the unused storage building block (#515; its allocation-gate sites are unreviewed, no bound claimed); a known limit (memory with never-filled pending orders, "a fix is planned for a later release").
- CI and release process: every merged change since 1.7.0 not listed above (#505-#510, #513, #514, #516, #519, #520, #522, #469, #481, #504). Every line is taken from the merged commit body; none claims a behaviour change for a tests-only or CI-only change.

Not in this commit (not on main at base `641349a`): the release gate, tmpwatch and the TvJO fix. Each gets one line from its merged PR body as a follow-up commit on this branch before this PR merges; this PR is meant to merge after those three.

## Checks

- Route: docs-only, `lab verify --via ci-only` (no sweep).
- Read as a committed diff by an independent reviewer: GO. All 18 engine commits `v1.7.0..641349a` have a bullet, none extra.
- Numbers: the #517 timings and RSS are the measurements in the #517 body; the ratios in the text were recomputed (1.77/0.36 = 4.9, 8.26/1.35 = 6.1, 8.94/5.39 = 1.66; 4.61/0.36 = 12.8, 22.31/1.35 = 16.5, 22.99/5.39 = 4.27).
- The heading date `2026-10-27` is the planned tag date and is corrected before the tag if the date moves.

🤖 Generated with [Claude Code](https://claude.com/claude-code)