ci: run workflows on self-hosted runners

[pheidon]

Summary

• Move non-fallback workflow jobs off GitHub-hosted runner labels and onto OMT self-hosted runner labels.
• Keep explicit hosted fork/fallback paths unchanged where present.
• Align workflow contract tests where this repository has them.

Governing Issue

No linked issue. This follows JT's direct policy request that CI jobs should not run on GitHub-hosted runners unless they are explicit fallbacks.

Validation

• git diff --check
• Workflow YAML parsed successfully
• Hosted-runner policy scan found no non-fallback direct ubuntu-*, macos-*, or windows-* runs-on jobs in this patched worktree
• Workflow YAML parse and policy scan only; no repo-specific build was needed for runner-label-only changes.

Bootstrap Governance

• Changes are scoped to the runner policy request
• Contributor or PR guidance changes are not required
• Auto-merge is enabled, or GitHub plan-limit evidence is recorded and the fallback merge-readiness policy applies
• No real secrets, runtime auth, or machine-local env files are committed

Merge Automation

• Auto-merge is enabled, or the reason it is unavailable or unsafe is noted below

Auto-merge is intentionally not enabled yet. This is a cross-repository runner policy migration and should land after CI confirms each repo's self-hosted route.

Notes

• Generated from /home/pheidon/.openclaw/workspace/reports/github-hosted-runner-audit-2026-05-31.md.
• Repositories with explicit fork fallback jobs keep those jobs on GitHub-hosted runners by design.