[codex] Enforce GCP release lab artifacts

.github/RUNNERS.md

@@ -1,8 +1,9 @@
-# Self-Hosted Runners
+# Runners And Trusted Labs
 
 OpenPhone uses GitHub-hosted runners for lightweight repository checks and
-self-hosted runners for work that needs a full Android tree or a physical
-phone.
+GCP lab VMs for trusted Android build and emulator work. Self-hosted runners
+are reserved for local hardware that cannot be represented by disposable cloud
+VMs, such as a physical phone connected over USB.
 
 Do not document private hostnames, SSH key names, public IP addresses, API
 keys, signing key paths, or device secrets in this file. Keep environment-
@@ -12,34 +13,20 @@ specific operator notes outside the public repository.
 
 | Label | Used by | Purpose |
 | --- | --- | --- |
-| `openphone-build` | `release.yml` | Builds Pixel/device artifacts on a large Linux Android build host. |
 | `openphone-emulator` | `emulator.yml` | Builds or reuses an OpenPhone SDK phone image, boots it in the Android emulator, and runs fast runtime smoke checks. |
 | `openphone-device` | `eval.yml` | Runs evals against an authorized Android device connected over USB. |
 
-## `openphone-build`
+## GCP Lab Builds
 
-The build runner needs:
+Release builds and trusted PR emulator lab runs are orchestrated from
+GitHub-hosted runners with Workload Identity Federation. The workflow creates a
+disposable GCP VM, attaches or restores warm Android cache state, runs the
+build/test commands inside that VM, copies artifacts back to GitHub Actions,
+and deletes the VM unless debugging explicitly keeps it.
 
-- Linux x86_64 host.
-- Full Android build dependencies for the selected LineageOS branch.
-- Several hundred GB of free disk space.
-- Java version required by the Android branch.
-- `repo`, `git-lfs`, `python3`, `bash`, and standard Android build tools.
-- Repository checkout with `.worktree/android` or `OPENPHONE_ANDROID_DIR`
-  pointing at the synced Android tree.
-
-Register the runner with labels similar to:
-
-```bash
-./config.sh \
-  --url https://github.com/<org>/<repo> \
-  --token <registration-token> \
-  --labels self-hosted,openphone-build \
-  --name openphone-build-<host>
-```
-
-Install it as a service according to GitHub's self-hosted runner instructions
-for the host OS.
+Do not use a generic self-hosted runner label for official release builds. The
+release workflow must show the GCP project, zone, VM name, source SHA, cache
+mode, and artifact directory in the workflow summary.
 
 ## `openphone-emulator`
 

.github/workflows/gcp-lab.yml

@@ -94,8 +94,8 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  gcp-lab-smoke:
-    name: GCP emulator lab smoke
+  gcp-emulator-lab:
+    name: GCP emulator lab
     if: >-
       ${{
         github.event_name == 'workflow_dispatch' ||
@@ -212,7 +212,7 @@ jobs:
             echo "keep_vm=$keep_vm"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Run GCP lab smoke
+      - name: Run GCP emulator lab
         shell: bash
         run: |
           set -euxo pipefail
@@ -250,6 +250,30 @@ jobs:
           done
           ./scripts/lab/gcp/run-smoke.sh "${args[@]}"
 
+      - name: Summarize GCP emulator lab
+        if: always()
+        shell: bash
+        run: |
+          {
+            echo "## GCP emulator lab"
+            echo
+            echo "- Cloud provider: \`GCP\`"
+            echo "- Project: \`${OPENPHONE_GCP_PROJECT}\`"
+            echo "- Zone: \`${OPENPHONE_GCP_ZONE}\`"
+            echo "- VM: \`${{ steps.target.outputs.name }}\`"
+            echo "- Source ref: \`${{ steps.target.outputs.ref }}\`"
+            echo "- Source repo: \`${{ steps.target.outputs.repo_url }}\`"
+            echo "- Runtime intents: \`${{ steps.target.outputs.runtime }}\`"
+            echo "- Emulator arch: \`${{ steps.target.outputs.arch }}\`"
+            echo "- Machine type: \`${{ steps.target.outputs.machine_type }}\`"
+            echo "- Cache mode: \`${{ steps.target.outputs.cache_mode }}\`"
+            echo "- Cache disk: \`${{ steps.target.outputs.cache_disk || 'none' }}\`"
+            echo "- Cache snapshot: \`${{ steps.target.outputs.cache_source_snapshot || 'none' }}\`"
+            echo "- VM service account: \`disabled\`"
+            echo "- VM OAuth scopes: \`disabled\`"
+            echo "- Keep VM: \`${{ steps.target.outputs.keep_vm }}\`"
+          } >> "$GITHUB_STEP_SUMMARY"
+
       - name: Upload GCP lab artifacts
         if: always()
         uses: actions/upload-artifact@v4