G7.4: advertise the fleet's runner labels, and correct my own doctrine

Surveyed ten repos: 36 of 36 ACTIVE workflows already say
runs-on: [self-hosted, linux, x64]. They were written for the self-hosted
runners that died when the repos went private — so advertising those three
labels makes every one of them runnable AS-IS. No workflow edits, no rewrites.

Correcting an earlier note in this plan: 'ban ubuntu-latest' was wrong as
stated. All 11 occurrences are tagged '# runner-lint-allow — CD/hosted-only;
disabled, manual until CD mission'. They are deliberately hosted-only and
deliberately off. They are correct as written and should not be 'fixed'.

I generalised that doctrine from one repo without surveying. The survey
disagreed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

DNA_STRAND_MASTER_PLAN.md

@@ -350,7 +350,8 @@ and landed in R2 at `lfs/34/2d/…`, with **no local `lfs/` directory on the hos
 - **G7.2** Runner isolation: containers only, no host Docker socket mount, no host network, no credential in the runner environment beyond the job's own scoped token (I-5).
 - **G7.3** Migrate `windy-git`'s own `make check` to Gitea Actions. **Dogfood before anything else moves.**
 - **G7.4** Migrate the **private** repos that GitHub cannot run at all — the ones where Actions is dead entirely, even self-hosted. This is the single largest immediate win in the plan.
-- **G7.5** ⚠️ **Ban `ubuntu-latest`.** All four `windy-registry` workflows use it and every run fails. Runner labels are explicit and pinned.
+- **G7.5** Runner labels are explicit and pinned, and they match **the fleet's existing convention**. Surveyed 2026-08-12 across ten repos: **36 of 36 active workflows already say `runs-on: [self-hosted, linux, x64]`** — written for the self-hosted runners that died when the repos went private. Advertising `self-hosted` + `linux` + `x64` makes all 36 runnable **as-is, with no workflow edits**.
+  ⚠️ Correction to an earlier note in this plan: `ubuntu-latest` is *not* an ecosystem-wide mistake. The 11 occurrences are all tagged `# runner-lint-allow — CD/hosted-only; disabled, manual until CD mission` — deliberately hosted-only and deliberately off. Do not "fix" them; they are correct as written. A job asking for `[self-hosted, linux, x64]` matches only a runner advertising **all three** labels.
 - **G7.6** Revive the fleet canary: regenerate `kit-army-config/docs/deployed-state.json` on a schedule from Windy Git CI. **It has been 37+ days dead since 2026-07-03**, and its old workflow returns `startup_failure` on every run.
 - **G7.7** Artifacts and logs to R2 (G4.1).
 - **G7.8** *Accept:* a deliberately broken commit to a private repo produces a red check on the PR — **which is something that has not happened anywhere in this ecosystem in over a month.**

deploy/runner/config.yaml

@@ -18,8 +18,20 @@ runner:
   fetch_timeout: 5s
   fetch_interval: 2s
   labels:
+    # windy-git's own workflows.
     - "veron-1:docker://catthehacker/ubuntu:act-22.04"
     - "linux-x64:docker://catthehacker/ubuntu:act-22.04"
+    # THE FLEET'S EXISTING CONVENTION. Surveyed 2026-08-12 across ten repos:
+    # 36 of 36 active workflows say `runs-on: [self-hosted, linux, x64]`.
+    # They were written for the self-hosted runners that died when the repos
+    # went private, so advertising these three labels makes every one of them
+    # runnable AS-IS — no workflow edits, no rewrites.
+    #
+    # A job asking for [self-hosted, linux, x64] matches only if the runner
+    # advertises ALL THREE, so all three are declared separately.
+    - "self-hosted:docker://catthehacker/ubuntu:act-22.04"
+    - "linux:docker://catthehacker/ubuntu:act-22.04"
+    - "x64:docker://catthehacker/ubuntu:act-22.04"
 
 cache:
   enabled: true