ci: use shared runners for general workflows

.github/workflows/actions-queue-health.yml

@@ -16,8 +16,8 @@ jobs:
   collect:
     name: Collect exact-head queue evidence
     runs-on:
-      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
-      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).labels }}
     timeout-minutes: 30
     permissions:
       contents: read

.github/workflows/agent-mention-noema-dispatch.yml

@@ -29,8 +29,8 @@ jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
     runs-on:
-      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
-      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).labels }}
     timeout-minutes: 5
     permissions:
       actions: read

.github/workflows/agent-mention-opencode-dispatch.yml

@@ -29,8 +29,8 @@ jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
     runs-on:
-      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
-      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).labels }}
     timeout-minutes: 5
     permissions:
       actions: read

.github/workflows/agent-mention-router-quality-ci.yml

@@ -47,8 +47,8 @@ env:
 jobs:
   quality:
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     timeout-minutes: 20
     steps:
       - name: Harden runner

.github/workflows/agent-review-runtime-quality-ci.yml

@@ -150,8 +150,8 @@ jobs:
   agent_review_runtime_quality:
     name: agent-review-runtime-quality
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     timeout-minutes: 25
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

.github/workflows/audit-central-ruleset.yml

@@ -26,8 +26,8 @@ jobs:
   audit:
     name: Audit organization ruleset 18156473
     runs-on:
-      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
-      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).labels }}
     env:
       GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
     steps:

.github/workflows/cloudflare-dns.yml

@@ -45,8 +45,8 @@ jobs:
   reconcile:
     name: Reconcile zones (${{ github.event.client_payload.mode || 'dry-run' }})
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/codeql-pr.yml

@@ -61,8 +61,8 @@ jobs:
     # Draft PRs get no runner; ready_for_review re-runs this on the same head.
     if: (github.event.action != 'closed') && (github.event.pull_request.draft != true || github.event.action == 'converted_to_draft' || github.event.action == 'closed')
     runs-on:
-      group: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
-      labels: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
+      group: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).group }}
+      labels: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).labels }}
     timeout-minutes: 5
     permissions:
       contents: read
@@ -167,8 +167,8 @@ jobs:
     # closed PR, where this job being implicitly skipped too is fine because
     # closed PRs need no required check.
     runs-on:
-      group: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
-      labels: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
+      group: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).group }}
+      labels: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).labels }}
     # Verdict reads have exceeded five minutes; retain the ten-minute control budget.
     timeout-minutes: 10
     permissions:
@@ -522,8 +522,8 @@ jobs:
       && needs.detect-languages.result == 'success'
       && needs.detect-languages.outputs.code == 'true'
     runs-on:
-      group: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
-      labels: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
+      group: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).group }}
+      labels: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}')).labels }}
     timeout-minutes: 5
     permissions:
       contents: read

.github/workflows/company-default-head-trust-gate.yml

@@ -24,8 +24,8 @@ permissions:
 jobs:
   validate:
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, Linux, X64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, Linux, X64]
     timeout-minutes: 5
     outputs:
       runner_matrix: ${{ steps.runner.outputs.runner_matrix }}

.github/workflows/company-settlement-validate.yml

@@ -7,8 +7,8 @@ permissions:
 jobs:
   validate:
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, Linux, X64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, Linux, X64]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:

.github/workflows/dependency-review.yml

@@ -94,8 +94,8 @@ permissions:
 jobs:
   dependency-review:
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     env:
       # Opts every JS action this job runs (checkout, dependency-review-action)
       # into the Node 24 actions runtime ahead of GitHub's default cutover,

.github/workflows/deploy-pages.yml

@@ -46,8 +46,8 @@ jobs:
   deploy_pages:
     name: Deploy ${{ inputs.project_name }}
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     steps:
       - name: Checkout caller repo
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/exact-artifact-sbom-attestation.yml

@@ -65,8 +65,8 @@ jobs:
   verify-evidence-artifact:
     name: Verify inert sealed evidence
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     timeout-minutes: 15
     permissions:
       actions: read
@@ -183,8 +183,8 @@ jobs:
     name: Attest exact wheel and sdist SBOMs
     needs: verify-evidence-artifact
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     timeout-minutes: 20
     permissions:
       actions: read

.github/workflows/exact-head-coverage-quality-gate.yml

@@ -38,8 +38,8 @@ permissions:
 jobs:
   quality-gate:
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     timeout-minutes: ${{ inputs.timeout_minutes }}
     steps:
       - name: Checkout exact source revision

.github/workflows/fast-mlsirm-cflite_pr.yml

@@ -10,8 +10,8 @@ jobs:
   PR:
     if: ${{ !github.event.pull_request.draft && github.event.action != 'closed' }}
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     permissions:
       contents: read
       security-events: write

.github/workflows/fast-mlsirm-ci.yml

@@ -21,8 +21,8 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }}
     name: python (${{ matrix.python-version }})
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     strategy:
       fail-fast: false
       matrix:
@@ -51,8 +51,8 @@ jobs:
     needs: python-matrix
     if: ${{ always() && (github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed')) }}
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     steps:
       - name: Require every CPython matrix leg
         run: |
@@ -63,8 +63,8 @@ jobs:
   rust:
     if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }}
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
@@ -92,8 +92,8 @@ jobs:
     # non-execution allowlist entry. The full paper-design recovery study
     # remains in the scheduled/manual workflow.
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     timeout-minutes: 240
     env:
       WGPU_BACKEND: vulkan
@@ -229,8 +229,8 @@ jobs:
     # dev extra); this job adds the Atheris coverage-guided harnesses with a
     # ~60s-per-target budget. Longer campaigns can be run nightly if desired.
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
@@ -280,8 +280,8 @@ jobs:
   package:
     if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }}
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:

.github/workflows/fast-mlsirm-codeql.yml

@@ -16,8 +16,8 @@ jobs:
     # on PRs. Default setup is disabled; this reusable workflow uploads SARIF.
     name: Analyze (actions)
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     permissions:
       contents: read
       security-events: write
@@ -39,8 +39,8 @@ jobs:
     if: github.event_name == 'workflow_dispatch'
     name: Analyze (python)
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     permissions:
       contents: read
       security-events: write

.github/workflows/fast-mlsirm-hourly-pr-governance.yml

@@ -16,8 +16,8 @@ jobs:
   governance-evidence:
     name: Hourly PR queue governance evidence
     runs-on:
-      group: CWL CI isolated
-      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     timeout-minutes: 10
     steps:
       - name: Check out reviewed source