ci: replace ubuntu-slim fallback with free ubuntu-24.04

[kyle-sexton]

What

Swap the paid ubuntu-slim hosted fallback for the standard, free
ubuntu-24.04 runner across the selector job and the three fail-closed
selector-result reporters:

• .github/workflows/select-runner.yml — selector job fallback
• .github/workflows/semantic-pr.yml — pr-title reporter fallback
• .github/workflows/do-not-merge-gate.yml — do-not-merge reporter fallback
• .github/workflows/pr-issue-linkage.yml — pr-issue-linkage reporter fallback

Also updated:

• the adjacent cost-framing comments (which called the fallback the
  "least-expensive/inexpensive hosted" runner) so they state the honest
  new behavior;
• the .cjs contract tests that pin the literal
  (select-runner.test.cjs, semantic-pr.test.cjs);
• the three README.md lines that describe this fallback/reporter
  behavior, so the docs land with the change they describe.

Why

ubuntu-slim is billed even on public repositories. This public repo
burned 6,906 minutes for $13.44 net in July (observed in org billing).
ubuntu-24.04 is free on public repos and quota-covered on private
ones, so the fallback carries no minutes cost while preserving the
fail-closed reporting contract: a non-success selector outcome still
materializes the required check on a hosted runner, and successful calls
still consume exactly the caller-selected runner.

No consumer contract change — same inputs, permissions, and secrets; only
the internal hosted fallback label changes.

Verification

• node --test on both .cjs suites: 104 pass, 0 fail.

• Sanity grep over the whole worktree is clean:

  $ git grep -n "ubuntu-slim"
  (zero matches)
  

Related

No linked issue. Part of the org-wide Actions zero-spend effort;
companion PR: melodic-software/medley#1570 (parks the paid hosted lanes
there).

🤖 Generated with Claude Code

[claude]

Claude finished @kyle-sexton's task in 2m 19s —— View job

---

Code Review

• Gather PR diff and context
• Review workflow YAML changes
• Review test file changes
• Review README changes
• Post final review

---

Verdict: Looks good — approve. The change is mechanically correct, internally consistent, well-motivated, and does not touch any security-sensitive surface.

---

Workflow YAML changes

All four runs-on lines are updated correctly and consistently:

File	Before	After
select-runner.yml:69	ubuntu-slim	ubuntu-24.04
semantic-pr.yml:96	ubuntu-slim	ubuntu-24.04
do-not-merge-gate.yml:42	ubuntu-slim	ubuntu-24.04
pr-issue-linkage.yml:46	ubuntu-slim	ubuntu-24.04

One detail worth noting: select-runner.cjs:3 already defines DEFAULT_HOSTED_RUNNER = "ubuntu-24.04", meaning the JS selector logic was already returning ubuntu-24.04 as the hosted fallback for consumers. The YAML literals being fixed here are the selector job's own runs-on and the three reporter jobs' runs-on — a genuine inconsistency that's now resolved.

Fail-closed contract preserved. The ternary pattern prerequisite-result == 'success' && inputs.runner || 'ubuntu-24.04' in the three reporter workflows is unchanged in structure; only the fallback label changed. The contract that a non-success selector result still materialises the required check on a hosted runner is intact.

Adjacent comments updated correctly. do-not-merge-gate.yml, select-runner.yml, and semantic-pr.yml all had cost-framing comments; all three were updated. pr-issue-linkage.yml's adjacent comment is about job ID naming convention (not cost), so no update was needed there — correct omission.

CLAUDE.md security rules. No event triggers, permissions, secrets scope, or checkout ordering changed. The pull_request-only tripwire in claude-review is untouched. Nothing here broadens the CLAUDE_CODE_OAUTH_TOKEN scope or downgrades token isolation. ✓

Test changes

select-runner.test.cjs updates the regex that asserts the literal runs-on expression in the workflow file. semantic-pr.test.cjs updates both the regex assertion and the runnerFor helper that mirrors the ternary logic — the helper correctly validates that any non-success result (including empty string) resolves to ubuntu-24.04 rather than the caller-supplied runner.

One pre-existing observation (not introduced here): pr-issue-linkage.test.cjs and the absence of a do-not-merge-gate.test.cjs mean there are no contract tests asserting the literal runs-on in those two reporter workflows. That gap existed before this PR and isn't a blocker, but it's the reason the ubuntu-slim inconsistency in those files wasn't caught by tests earlier.

README changes

All three prose references to the old fallback label are updated accurately. The parenthetical "(free on public repos, quota-covered on private)" is technically correct: ubuntu-24.04 consumes included GitHub-provided minutes on private repos while costing nothing on public ones.

One minor wording note — the README at the updated line says the fallback is "free on public repos" without caveating that ubuntu-24.04 starts up slightly slower than ubuntu-slim (larger image). For the use case here (shell-only selector/reporter jobs with 2- and 15-minute timeouts) this is completely negligible and doesn't warrant a comment change.

Summary

Clean, well-scoped change. Correct everywhere, consistent everywhere, no security-surface changes, tests updated, docs land with the change. Ready to merge.