ci(runners): use github-hosted validation

[JSONbored]

Summary

• move the remaining Gittensory CI validation job from self-hosted runners to GitHub-hosted runners
• move dependency audit to ubuntu-latest
• make the self-host maintenance workflow manual-only and GitHub-hosted, gated on SELF_HOST_URL

Why

The self-hosted review stack is CPU constrained. Keeping PR validation on the same VPS competes directly with review processing and causes the contributor review queue to stall.

Validation

• git diff --check
• npm run actionlint could not complete before dependencies were installed in the fresh worktree (github-actionlint module missing); CI will run the workflow lint with dependencies installed.

[codecov]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
7558	2	7556	7

View the top 2 failed test(s) by shortest run time

test/unit/workflow-runner-labels.test.ts > workflow runner labels > keeps only the build/test job on the gittensory runner pool; non-build jobs run on GitHub-hosted runners

Stack Traces | 0.0154s run time

AssertionError: expected [] to have a length of 1 but got +0

- Expected
+ Received

- 1
+ 0

 ❯ test/unit/workflow-runner-labels.test.ts:16:90

test/unit/workflow-runner-labels.test.ts > workflow runner labels > keeps scheduled audit work on the trusted self-hosted pool

Stack Traces | 0.044s run time

AssertionError: expected 'name: Dependency audit\n\n# Full-tree…' to contain 'runs-on: [self-hosted, gittensory]'

- Expected
+ Received

- runs-on: [self-hosted, gittensory]
+ name: Dependency audit
+
+ # Full-tree `npm audit` for ambient advisories (vulnerabilities in deps no PR
+ # touched). This is intentionally NOT a per-PR gate: PRs are gated on the
+ # vulnerabilities they introduce via the dependency-review job in ci.yml, and
+ # Renovate (vulnerabilityAlerts) + GitHub Dependabot alerts open the fix PRs.
+ # This run keeps the whole tree under active audit on a cadence and on demand.
+
+ on:
+   schedule:
+     - cron: "0 16 * * 1" # Mondays 16:00 UTC (~9am America/Phoenix), aligns with Renovate
+   workflow_dispatch:
+
+ permissions:
+   contents: read
+
+ concurrency:
+   group: audit
+   cancel-in-progress: true
+
+ jobs:
+   audit:
+     name: audit
+     runs-on: ubuntu-latest
+     timeout-minutes: 10
+     steps:
+       - name: Checkout
+         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+       - name: Setup Node
+         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+         with:
+           node-version-file: .nvmrc
+           cache: npm
+       - name: Install dependencies
+         run: npm ci
+       - name: Full dependency audit
+         run: npm audit --audit-level=moderate
+

 ❯ test/unit/workflow-runner-labels.test.ts:39:22

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}