chore(ci): gate arm64/macOS matrix jobs on repo vars + continue-on-error

[luthermonson]

Summary

Stops the arm64/macOS matrix builds from sitting in Pending on every PR. Two changes per gated job:

• `if: ${{ vars.HAS__RUNNER == 'true' }}` — when the repo variable isn't set (i.e. no runner online), the job is Skipped instead of stuck Pending. To turn the matrix back on once a runner is up:
  ```
  gh variable set HAS_LINUX_ARM64_RUNNER --body true
  gh variable set HAS_MACOS_ARM64_RUNNER --body true
  ```
• `continue-on-error: true` — when the runner is online, a failure here doesn't fail the PR check group. These two platforms aren't covered by the primary CI box so we tolerate flake; the Linux+Windows runs catch real regressions.

`Build (Windows amd64)` is unchanged — the self-hosted Windows runner is live (it's this box) and that build sanity check is genuinely useful.

Background

PR #73 and #74 both have `Build (Linux arm64)` and `Build (macOS arm64)` stuck Pending right now. Those PRs are otherwise green and merge-ready; this fixes the symptom that makes them look not-merge-ready.

Test plan

• YAML reviewed by hand — `if:` syntax matches GHA examples, `continue-on-error` at job level (not step level).
• Confirm in CI on this very PR that the two gated jobs come back as Skipped rather than Pending. (Pre-merge check; the workflow change applies to itself.)
• After merge, confirm PR feat(runtime): add configurable rlimits (nofile/nproc) for jobs #73 and feat(dind): gate docker run --privileged / --cap-add behind config #74 re-run pick up the new behavior.

Follow-ups

Branch protection rules (settings/branches) may still list `Build (Linux arm64)` / `Build (macOS arm64)` as required checks — if so, merges on PRs where these are Skipped will be blocked. Check that and either remove them from required, or rely on Skipped counting as success (GitHub's docs say it does for required-checks purposes since `if:`-skipped jobs report `conclusion: skipped` which the merge gate accepts).