[codex] Use self-hosted native runners

[jmcte]

Summary

• Move APW shell-safe, Rust, release tap, and Claude automation jobs off ubuntu-latest and onto the shared self-hosted Linux shell-safe runner contract.
• Keep native Swift/macOS jobs on the existing self-hosted macOS ARM64 Xcode pool.
• Document the native-repo policy so APW no longer treats GitHub-hosted runners as the fallback for required automation.

Validation

• ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f); puts f }' .github/workflows/*.yml
• git diff --check
• bash scripts/ci/run-fast-checks.sh - passed

Notes

• No linked issue was provided in the request.
• This supersedes the already-merged hosted-runner direction from APW PR Use hosted runners for extended shell jobs #88.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ed0f5e07b6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[athena-omt]

Request changes: the policy update is incomplete because runtime apw doctor guidance still points at the old [self-hosted, synology, shell-only, public] pool. The new onboarding/docs now direct operators to [self-hosted, linux, shell-only, public], so the tool and the written policy disagree. Please update rust/src/native_app.rs and any related tests before merge.

[jmcte]

Addressed the requested doctor/runtime policy drift in commit 0dacbd2:

• Updated rust/src/native_app.rs so apw doctor now points shell-safe CI jobs at [self-hosted, linux, shell-only, public].
• Added regression coverage to assert the Linux shell-only pool is documented and the retired Synology pool is not mentioned.

Local verification:

• cargo test --manifest-path rust/Cargo.toml doctor_does_not_create_default_credentials_file_without_demo_gate
• cargo fmt --manifest-path rust/Cargo.toml -- --check
• git diff --check origin/codex/native-self-hosted-runners..HEAD
• bash scripts/ci/run-fast-checks.sh

Current GitHub state after push: Rust test and lint are queued on the PR branch.

[athena-omt]

Approved. The prior policy drift is resolved: apw doctor now points shell-safe jobs at [self-hosted, linux, shell-only, public], the workflow/docs updates are aligned with that same runner contract, and the new regression coverage keeps the retired Synology label from coming back. I didn’t find any additional blockers in this PR.

[pheidon]

Findings:

1. .github/workflows/rust-ci.yml:10 and .github/workflows/lint.yml:8 now route Rust build/lint jobs to [self-hosted, linux, shell-only, public], but the live PR checks show that pool does not currently have a C linker. Both failing jobs die at cargo clippy with error: linker cc not found on linux-public-runner-01. Because these workflows compile crates with build scripts/native dependencies, this runner label change makes required Rust validation red until the pool image includes cc or these jobs stay on a runner that already has a C toolchain.

2. .github/workflows/claude.yml:35 moves Claude automation to [self-hosted, linux, shell-only, public] while the same job reads ANTHROPIC_API_KEY and has write permissions for contents, PRs, issues, id-token, and actions. That is a secret-bearing automation path, not just shell-safe CI. It should remain on a trusted hosted/private runner or a dedicated trusted self-hosted pool, not the public shell-only fleet.

Validation I ran locally:

• git diff --check bad72ff23033753c5985206508cc10cae8fed7a9..HEAD
• CARGO_TARGET_DIR=/tmp/apw-cli-89-review-target cargo test --manifest-path rust/Cargo.toml native_app::tests::doctor_does_not_create_default_credentials_file_without_demo_gate -- --nocapture

The native-app diagnostic test passed locally; the blocking concerns are runner capability and secret-bearing workflow placement.

Stale review on ed0f5e0: apw doctor runner guidance and regression coverage were addressed in 0dacbd2, then the branch was updated again in ff63e5f.