ci(runners): rebalance CI load for self-host reliability

[JSONbored]

Parent: #1819

Context

Same-repo PRs and main validation can put heavy load on the self-hosted runner pool. Fork PRs already need a safer trust boundary and should not run untrusted code on secret-bearing self-hosted runners.

This issue evaluates runner routing and CI fanout so review checks finish predictably without weakening security.

Requirements

• Map every workflow job to its current runner class for push, same-repo PR, and fork PR events.
• Identify which jobs can safely run on GitHub-hosted runners to reduce self-host pressure.
• Keep secret-bearing or environment-dependent jobs off untrusted fork code.
• Preserve branch protection semantics around the aggregate validate check.
• Review concurrency groups and cancellation behavior to avoid unnecessary restarts or stranded pending checks.
• Measure whether self-host labels, runner count, or job partitioning cause internal PR queues to stall.

Deliverables

• Runner routing matrix for all CI workflows.
• Recommended split between GitHub-hosted and self-hosted jobs.
• Proposed workflow changes, if any, with security rationale.
• Guidance for runner capacity, labels, and autoscaling/future runner pools.
• Regression tests or actionlint coverage where workflow logic changes.

Acceptance criteria

• Fork PRs remain isolated from self-hosted secret-bearing infrastructure.
• Internal PR CI has fewer avoidable queue stalls and restarts.
• Required checks remain stable and do not strand PRs at pending due to path-filtered jobs.
• Any workflow change is documented enough that future maintainers understand the trust boundary.

Validation

• Run npm run actionlint after workflow changes.
• Verify a same-repo PR and fork-shaped event route to the expected runner classes.
• Confirm validate aggregates all required jobs correctly.

Ownership

Maintainer-only. No gittensor:* labels.

[JSONbored]

Investigated against the current tree, now that the two child issues have shipped.

Runner-routing (the bulk of the ask) — DONE. #2501/#2507 merged today (PR #2575): changes, security, and validate in .github/workflows/ci.yml are now unconditionally runs-on: ubuntu-latest; only validate-code (the actual npm/build/test job) keeps the fork-aware self-hosted/ubuntu-latest expression. test/unit/workflow-runner-labels.test.ts was updated to assert exactly this shape.

Checked every other self-hosted-runner reference in .github/workflows/*.yml for false-positive routing candidates — found none:

• audit.yml — schedule-only + workflow_dispatch, never contends with PR CI queues.
• self-host-nightly.yml — genuinely needs the self-hosted box (curls the stack over its internal Docker network by service name; cannot run on GitHub-hosted).

Concurrency-cancellation requirement — was still open, now in flight. selfhost.yml had no concurrency: block at all. That's tracked by sub-issue #2496, which I've just shipped as PR #2577 (adds the same push/pr-split cancel-in-progress group ci.yml already uses). Will close #2496 once that merges.

Runner pool sizing/autoscaling — the remaining item in the original ask ("runner capacity, labels, and autoscaling/future runner pools") is infra-level, not something a code-only investigation/PR can resolve from this repo. Suggest either an explicit "deferred, infra-level, out of scope for this repo" note here, or narrowing this issue to just that remaining deliverable once #2496 merges.

Recommendation: leave open until #2496 merges (closes the concurrency gap), then re-scope to just the pool-sizing/autoscaling deliverable or close with that noted as deliberately deferred.

[JSONbored]

Closing as functionally complete. Runner routing/fanout is now resolved by tonight's work:

• ci: route the security dependency-review job off the self-hosted runner pool #2501/ci: route changes/validate jobs off the self-hosted runner pool #2507 (merged): changes, security, validate route unconditionally to ubuntu-latest; only validate-code (the one job that benefits from the self-hosted VPS's cached toolchain) stays on [self-hosted, gittensory], fork-aware.
• ci(selfhost): add a concurrency cancel-in-progress group to selfhost.yml #2496 (merged): selfhost.yml now has a concurrency cancel-in-progress group matching ci.yml/upstream-contract.yml, closing the 'unnecessary restarts' requirement.
• Verified no other workflow inappropriately uses the self-hosted pool: audit.yml (schedule-only) and self-host-nightly.yml (genuinely needs the VPS's internal Docker network) are both correctly pinned.
• Fork isolation, validate aggregation semantics, and actionlint coverage are all unchanged/preserved by these fixes (confirmed via test/unit/workflow-runner-labels.test.ts).

The remaining deliverable — 'guidance for runner capacity, labels, and autoscaling/future runner pools' — is a live-infrastructure sizing decision, not something a code PR can resolve; deferred to actual operational data once the beta-stable release (#1936) sees real load. Re-open if a routing gap resurfaces.