chore(ci): self-hosted runner for the game-coupled tier

[aram-devdocs]

Provision a self-hosted runner with a local Sailwind install so CI can run the net472 full-solution build, the Sailwind.Api.SurfaceTests, and an API-surface drift check (mirroring the FlatBuffers contracts drift job). Today those run only locally via make validate. Game DLLs still never enter the cloud.

[aram-devdocs]

Handoff: No CI job exists yet (the game-coupled tier runs only locally, gated on lib/Assembly-CSharp.dll). Remaining (ops + config): provision a self-hosted runner with a Steam+Sailwind install, then add a NON-BLOCKING (continue-on-error, NOT in gate.needs) game-coupled CI job that builds SailwindOnline.sln -c Release (net472), runs Sailwind.Api.SurfaceTests, and adds an api-surface drift check (regen via generate-api + git diff --exit-code, mirroring the FlatBuffers contracts job). The job can't be proven green in cloud CI without the runner, hence non-blocking.

[aram-devdocs]

Blocked on the runner host and trust-policy decision. This repository is public and currently has zero registered runners. Attaching a personal Steam workstation to the existing pull-request workflow would expose it to untrusted Actions code. Before implementation, choose: (1) an isolated Windows host, (2) persistent service or ephemeral execution, (3) protected-push-only or same-repository-PR triggers, and (4) latest or pinned Sailwind build. The recommended baseline is isolated compute, a custom runner label, protected pushes only, read-only permissions, checkout credentials disabled, and no game-coupled artifact or cache upload. After that choice, the repository work is a non-required game-coupled job that provisions ignored lib/, builds the full solution, runs Sailwind.Api.SurfaceTests, regenerates the API, and fails on drift without joining gate.needs.