feat(ci): add governed local runner routing

[kyle-sexton]

Summary

• Routes eligible private Linux CI workloads through the centralized immutable selector with explicit ubuntu-24.04 hosted fallback.
• Keeps Zizmor, runner-policy enforcement, ci-status, Claude review, link checking, public/fork execution, and privileged control-plane jobs on GitHub-hosted runners.
• Preserves required-check and merge-queue behavior.
• Adds the governed runner-policy contract and dependency-update coverage.
• Does not change plugin or catalog behavior.

Merged dependencies

• melodic-software/ci-workflows#74: 99ac2f8c5b09dbb785d4eaf18465cbd96c30290c
• melodic-software/standards#85: ff4b47341693dcd6bd8a55e52aa5f7fe7a1eacd8
• melodic-software/github-iac#55: 3e1fa5d882ea1738b45b1ee50f7da55ff6a5066c

Final reviewed evidence

• Exact signed PR head: 6f46fc6500f63606dd312a936f1217656d1b147d
• Final selector pin: 99ac2f8c5b09dbb785d4eaf18465cbd96c30290c
• Final selector references: 42
• Superseded c34f0aa / fd9a74d references: 0
• Intentional 1d3762c compatibility references retained unchanged: 6
• All 20 unique pinned action/workflow paths exist at the immutable final selector commit.
• Runner policy is byte-identical to Standards ff4b473, Git blob b3cf17a861fa59b19536d371b8ede21640fab48a.
• Independent implementation review: PASS, no code findings.
• Runner policy, checksum-verified Actionlint/ShellCheck, structural plugin/catalog validation, canonical-reference checks, and diff checks: PASS.
• Zizmor has zero medium/high findings and improves versus the base branch.
• Hosted GitHub checks at the exact PR head: 33/33 successful.
• plugins/ and .claude-plugin/ remain byte-identical to the PR base.

Rollout gate

This PR intentionally remains draft and unmerged. It will be reconciled with main only after the immutable fleet release, desktop canary, two-host HA proof, and the organization rollout gate are ready. Keeping it draft prevents CI routing from becoming active before the live control plane is proven.

---

Note

High Risk
Large CI workflow refactor changes where jobs execute and how required checks fail closed; mis-routing or org-variable gaps could block merges or shift untrusted work onto the local fleet.

Overview
Introduces governed CI runner routing so eligible private Linux validation lanes run through per-job select-runner reusable workflows (org vars + pinned ci-workflows SHAs), with ubuntu-24.04 only as an explicit fallback when selection succeeds—not as a silent escape from strict self-hosted-only misconfiguration.

ci.yml gains a selector job ahead of each quality lane, merge_group triggers, a hosted runner-policy enforcement job, pinned ci-workflows@99ac2f8, and stricter ci-status aggregation (workloads must be success; skipped no longer passes). pr-title.yml mirrors the selector pattern and adds a small hosted pr-title / pr-title gateway that fails if routing or semantic validation fails.

Adds .github/runner-policy.json, docs/CI-RUNNER-ROUTING.md, and locked CI toolchains: root package.json / package-lock.json (Biome + Claude Code via npm ci), hash-pinned Ruff in .github/requirements-ci.txt, and expanded Dependabot coverage for npm/pip plus the standards runner-policy package root. plugin-gate installs those locked tools instead of mutable global installs so hosted and self-hosted contract tests see the same binaries.

^{Reviewed by Cursor Bugbot for commit 394ab0d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_a1676679-db74-4a6e-9c43-24fb47d60391)

[cursor]

Risk: medium. Not approving because Cursor Bugbot was present but skipped (usage limit reached), so automated review results are incomplete. Human review is needed; no reviewers were assigned because no non-author collaborators are available on this repository.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}