ci: route safe Linux workflows to self-hosted runners

.github/workflows/benchmark-harbor.yml

@@ -17,7 +17,7 @@ permissions:
 jobs:
   test:
     name: Python tests and lint
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'onlyarag-linux-x64' }}
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

.github/workflows/ci.yml

@@ -540,6 +540,11 @@ jobs:
         with:
           path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
           key: pnpm-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+      - name: Tear down ephemeral integration fixtures
+        # Job-scoped CI fixtures: remove the Postgres/Redis/MinIO containers
+        # and their named volumes at job end so nothing persists on the runner.
+        if: always()
+        run: docker compose down --volumes --remove-orphans
 
   desktop-e2e-integration:
     name: Desktop E2E Integration
@@ -698,6 +703,11 @@ jobs:
           name: backend-integration-relay-log
           path: /tmp/buzz-relay.log
           if-no-files-found: ignore
+      - name: Tear down ephemeral integration fixtures
+        # Job-scoped CI fixtures: remove the Postgres/Redis/MinIO containers
+        # and their named volumes at job end so nothing persists on the runner.
+        if: always()
+        run: docker compose down --volumes --remove-orphans
 
   relay-e2e:
     name: Relay E2E

.github/workflows/docker.yml

@@ -89,7 +89,7 @@ jobs:
       matrix:
         include:
           - platform: linux/amd64
-            runner: ubuntu-24.04
+            runner: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-24.04' || 'onlyarag-linux-x64-docker' }}
             arch: amd64
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
@@ -200,7 +200,7 @@ jobs:
   merge:
     name: Merge multi-arch manifest
     if: github.event_name != 'pull_request'
-    runs-on: ubuntu-24.04
+    runs-on: onlyarag-linux-x64-docker
     needs: build
     timeout-minutes: 15
     permissions:
@@ -315,7 +315,7 @@ jobs:
       matrix:
         include:
           - platform: linux/amd64
-            runner: ubuntu-24.04
+            runner: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-24.04' || 'onlyarag-linux-x64-docker' }}
             arch: amd64
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
@@ -383,7 +383,7 @@ jobs:
   push-gateway-merge:
     name: Publish public push gateway image
     if: github.event_name != 'pull_request'
-    runs-on: ubuntu-24.04
+    runs-on: onlyarag-linux-x64-docker
     needs: push-gateway-build
     timeout-minutes: 15
     permissions:

.github/workflows/helm-chart.yml

@@ -55,7 +55,7 @@ env:
 jobs:
   lint-and-unittest:
     name: lint + unittest + render matrix
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'onlyarag-linux-x64' }}
     permissions:
       contents: read
     steps:
@@ -114,7 +114,7 @@ jobs:
     # carries a version): that path only packages+publishes, it does not install.
     name: install on kind (gated)
     if: github.event_name == 'workflow_dispatch' && inputs.version == ''
-    runs-on: ubuntu-latest
+    runs-on: onlyarag-linux-x64-docker
     needs: lint-and-unittest
     permissions:
       contents: read
@@ -158,7 +158,7 @@ jobs:
     if: >
       startsWith(github.ref, 'refs/tags/chart-v') ||
       (github.event_name == 'workflow_dispatch' && inputs.version != '')
-    runs-on: ubuntu-latest
+    runs-on: onlyarag-linux-x64-docker
     needs: lint-and-unittest
     timeout-minutes: 15
     permissions:

.github/workflows/push-gateway-helm-chart.yml

@@ -20,7 +20,7 @@ env:
   CHART_REPO: oci://ghcr.io/block/buzz/charts
 jobs:
   validate:
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'onlyarag-linux-x64' }}
     permissions: { contents: read }
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
@@ -34,7 +34,7 @@ jobs:
   publish:
     if: github.event_name != 'pull_request'
     needs: validate
-    runs-on: ubuntu-latest
+    runs-on: onlyarag-linux-x64-docker
     permissions:
       contents: read
       packages: write