chore: run release workflows on self-hosted runners

[kaiitunnz]

Purpose

Switch both release workflows (release.yml, release-images.yml) from GitHub-hosted ubuntu-latest to self-hosted. PyPI Trusted Publishing via OIDC and GHCR auth via the auto-provisioned GITHUB_TOKEN both work identically on a self-hosted runner, so the publish/retag paths are unaffected.

Changes

• .github/workflows/release.yml — build and publish jobs now runs-on: self-hosted.
• .github/workflows/release-images.yml — verify and retag-latest jobs now runs-on: self-hosted.

Test Plan

uv run pre-commit run --all-files

Workflow logic is unchanged; the only edit is the runs-on value. End-to-end exercise will happen on the next release dispatch.

Test Result

$ uv run pre-commit run --all-files
# All checks passed

---

Pre-submission Checklist

• I have read the contribution guidelines.
• I have run `pre-commit run --all-files` and fixed any issues.
• I have added or updated tests covering my changes (if applicable).
• I have verified that `uv run pytest tests/` passes locally.
• If I changed shared schemas or proto definitions, I have checked downstream compatibility across Server and Worker.
• If I changed the SDK or CLI, I have verified the affected packages work (`uv sync --all-packages --group ci --frozen`).
• If this is a breaking change, I have prefixed the PR title with `[BREAKING]` and described migration steps above.
• I have updated documentation or config examples if user-facing behavior changed.