ci: run mirror verification on the self-hosted runners

[thedancingdeveloper]

cadastre spent 326 GitHub-hosted minutes in August, second only to FarmEggs, in breach of docs/CI-RUNNER-GATES.md. This moves the part that can move and formally excepts the part that should not.

What changes

publish.yml / verify → [self-hosted, node-b, linux, x64].

That workflow triggers only on push: branches: [main] and workflow_dispatch. It never builds unreviewed fork code, so the security argument written at the top of ci.yaml does not reach it. It is pure uv + Python — astral-sh/setup-uv brings its own interpreter, so it needs nothing the runner image lacks.

What deliberately does not change

ci.yaml stays on ubuntu-latest. Its header already states the reason, and it is correct:

This is a public repository, so pull_request builds untrusted fork code: putting that on the self-hosted pool would hand an arbitrary contributor code execution inside the estate.

The self-hosted workers are persistent, run as root inside their container, and sit on the tailnet with reachable Forgejo, Infisical, Komodo and registry endpoints. Org fork-PR approval is first_time_contributors, so a returning contributor's PR would execute without approval (gap 12 in ops/docs/github-actions-runner-gaps.md).

Instead of a silent breach, it is now an owner-approved, time-bounded entry in github-policy/runner-exceptions.json that the daily expiry check will surface.

Safety

verify is not a required status check on main — those are install, test (3.11)–test (3.14) and full-stack e2e, all in ci.yaml and all untouched. The workflow name Mirror verification (main) is preserved, per the warning in its own header.

🤖 Generated with Claude Code

[thedancingdeveloper]

Closing: this conflicts with a tested invariant in this repository, and that invariant is the better-reasoned rule.

tests/test_release_workflow.py draws the line at tag-gated, not at not-fork-reachable:

# Only a tag-gated workflow may take the trusted self-hosted pool. Everything
# else is reachable from a fork's pull request.
SELF_HOSTED_WORKFLOWS = frozenset({"release-images.yml", "release-pypi.yml"})

and test_self_hosted_workflows_are_all_tag_gated additionally asserts every entry on that allowlist is reachable only from refs/tags/v*. Moving publish.yml would have required weakening both tests.

My reasoning in the PR body was narrowly correct — a push to main needs write access, so publish.yml has no fork exposure — but it argued past the actual rule, which deliberately keeps the self-hosted surface as small as possible rather than merely fork-free. test (3.11)–test (3.14) caught it, which is the invariant doing its job.

The org-side resolution is to widen the exception instead: runner-exceptions.json now covers cadastre/publish.yml as well as ci.yaml, recording that this repository's hosted usage is a deliberate, tested security posture rather than drift. See TheDancingDeveloper-org/github-policy#5.