Move public CI to the public trust lane for broker cutover

[willgriffin]

Parent: happyvertical/iac#1088

Classify this public repository as the public/fork-safe trust lane required by the root-capable runner contract. Replace bare, transitional, provider-specific, and private self-hosted selectors in generic public workflows with ubuntu-latest; preserve only genuine platform-specific jobs such as macOS. Validate the changed workflows. This keeps untrusted public code off the brokered root-capable pool.

[willgriffin]

{"branch": "codex/107-runner-pool", "claimed_at": "2026-07-26T16:12:40Z", "heartbeat_at": "2026-07-26T18:11:56Z", "lease_seconds": 14400, "owner": "willgriffin", "release_evidence_sha256": "c802fdb5e72241b8bfe65299bd8149bfd58a7e279a54ff8473c038b087c47538", "release_message": "Ready for review: https://github.com/happyvertical/pdf/pull/108", "release_pr_heads": {"108": "cb7dc62ce13b8c7da0845671defdf44f37011eeb"}, "release_reason": "review", "released_at": "2026-07-26T18:31:03Z", "runtime": "codex", "schema": "hv-agent-claim:v1", "session": "codex-107-runner-pool-019f9ea2", "worktree": "/Users/will/Work/_trees/pdf/runner-pool-107"}

[willgriffin]

{"claim_comment_id": "IC_kwDOQmZF0M8AAAABLww-xQ", "heartbeat_at": "2026-07-26T16:56:05.886110Z", "schema": "hv-agent-heartbeat:v1", "session": "codex-107-runner-pool-019f9ea2"}

[willgriffin]

{"claim_comment_id": "IC_kwDOQmZF0M8AAAABLww-xQ", "heartbeat_at": "2026-07-26T18:02:18.841849Z", "schema": "hv-agent-heartbeat:v1", "session": "codex-107-runner-pool-019f9ea2"}

[willgriffin]

{"claim_comment_id": "IC_kwDOQmZF0M8AAAABLww-xQ", "heartbeat_at": "2026-07-26T18:11:55.914025Z", "schema": "hv-agent-heartbeat:v1", "session": "codex-107-runner-pool-019f9ea2"}

[willgriffin]

Ready for review: #108

[willgriffin]

Leaving this open, but the prescribed remedy — replacing self-hosted selectors with ubuntu-latest — conflicts with the operator's direction that nothing should leave the self-hosted lane, and #108 has been closed on that basis.

The stated risk is already mitigated: arc-happyvertical sets public_fork_pull_requests: 'deny' and admits this repository as eventTrust: same-repository only, and the broker independently requires head_repository.full_name === repositoryName and fork !== true before queueing a job. Untrusted fork code does not reach the root-capable pool.

If the intent is a genuinely separate public trust lane rather than eviction to GitHub-hosted runners, that is a capacity-profile question — see willgriffin/nixos-config#154, which is adding per-lane profiles. A public lane could be a distinct profile with its own node selector and its own contract, keeping the work on self-hosted hardware while isolating it from the root-capable pool. That would satisfy the classification goal without giving up the capacity.