ci: run workflows on self-hosted runners

[pheidon]

Summary

- Move non-fallback workflow jobs off GitHub-hosted runner labels and onto OMT self-hosted runner labels.
- Keep explicit hosted fork/fallback paths unchanged where present.
- Align workflow contract tests where this repository has them.

## Governing Issue

No linked issue. This follows JT's direct policy request that CI jobs should not run on GitHub-hosted runners unless they are explicit fallbacks.

## Validation

- [x] `git diff --check`
- [x] Workflow YAML parsed successfully
- [x] Hosted-runner policy scan found no non-fallback direct `ubuntu-*`, `macos-*`, or `windows-*` `runs-on` jobs in this patched worktree
- `pnpm exec vitest run test/workflow.test.ts test/release-workflow.test.ts test/security-workflow.test.ts`

• pnpm lint

  Bootstrap Governance

  • Changes are scoped to the runner policy request
  • Contributor or PR guidance changes are not required
  • Auto-merge is enabled, or GitHub plan-limit evidence is recorded and the fallback merge-readiness policy applies
  • No real secrets, runtime auth, or machine-local env files are committed

  Merge Automation

  • Auto-merge is enabled, or the reason it is unavailable or unsafe is noted below

  Auto-merge is intentionally not enabled yet. This is a cross-repository runner policy migration and should land after CI confirms each repo's self-hosted route.

  Notes

  • Generated from /home/pheidon/.openclaw/workspace/reports/github-hosted-runner-audit-2026-05-31.md.
  • Repositories with explicit fork fallback jobs keep those jobs on GitHub-hosted runners by design.