ci: move validation workflows off self-hosted Python runner

[an0mium]

Summary

• move CI, test, review, spec, benchmark, and governance workflows that install the Python package from runs-on: aragora to ubuntu-latest
• keep deploy, release, publish, and load-test workflows on self-hosted runners for a separate infra-focused pass
• follow up on PR ci: enforce python -m pip workflows + add pip-policy guard #673 by extending the hosted-runner Python hardening pattern across the broader validation surface

Validation

• python scripts/check_workflow_pip_install_policy.py
• python -m pytest tests/scripts/test_check_workflow_pip_install_policy.py -q

Intentionally Left Self-Hosted

• deploy pipelines: deploy-ec2.yml, deploy-lightsail.yml, deploy-secure.yml, deploy-canary.yml
• publish/release pipelines: publish-aragora.yml, publish-aragora-debate.yml, publish-sdk-python.yml, release.yml
• load/perf pipeline: load-tests.yml