ci: finish runner fleet update

[pheidon]

Summary

• move release-image, Security, Scorecard, and reusable rg-security jobs to GitHub-hosted runners so Docker/CodeQL tooling is current and writable
• update the Lume controller runtime default runner executable to GitHub Actions runner 2.334.0
• add test coverage that prevents the Lume runtime default from regressing to 2.333.0 and updates workflow placement expectations

Validation

• corepack pnpm test
• corepack pnpm build

Context

PR #128 upgraded the bundled runner executable to 2.334.0 and was merged, but the main branch release/security runs still failed on stale self-hosted runner infrastructure: Docker client/API mismatch, Scorecard container pull failure, and CodeQL toolcache permission errors. This follow-up keeps the project's release and security path on current hosted runner plumbing while shell-safe lane checks can remain self-hosted.