feat(ci): parallelize browser regression lane - #795

## Change

Release 0.4.7, from main at 80ca9bb (47 PRs since v0.4.6).

- `package.json` and `herdr-plugin.toml`: 0.4.7.
- CHANGELOG: `[Unreleased]` becomes `[0.4.7] - 2026-10-12`, with the
compare links.
- #513's entry moves out of the 0.4.0 section, where its branch's merge
left it, and gets its credit; it says the pace is a setting, off by
default (#834).
- A Maintenance section covers the PRs that had no entry: #743, #756,
#767, #795, #805, #810, #813, #821, #826, #831.
- The note under the Hermes entry that asked for a runtime bump at
release now says what a remote PC needs.
- `release-summaries.json`: 0.4.7 in en/ko/ja/zh/tr (6 new, 6 improved,
5 fixed). The Turkish lines are not checked by a native speaker.
- `REMOTE_BUNDLE_VERSION` 25 -> 26. Since v0.4.5's runtime the bridge
gained Hermes transcripts (#604), conversation pushes (#689) and
Grok/Antigravity activity (#816), so `remote-v26` is published before
the app release.

Not in this release: #606.

## Validation

- `bun scripts/release-notes.ts 0.4.7` renders the summaries and the
full changelog (235 lines).
- `bun run typecheck` and `bun run build`: pass.
- `TMPDIR=/tmp bun run test:unit`: one failure, `server/voice.test.ts`
("audio.webm" vs "clip.webm"), which fails the same way on unmodified
`main` on this Mac (Bun 1.4.0); CI runs Bun 1.4.2.
- Every PR merged since v0.4.6 was checked against the changelog
section: all 47 are linked.

## Release

After this merges and its CI on `main` passes: push `remote-v26`, wait
for its release, then run the Release workflow with `0.4.7`.

…d runner (#873)

## Change

Review of CI after the recent merges (#795 browser lane parallelization,
#805 CI setup speedups), with two defects fixed and an opt-in
self-hosted runner for Linux CI/CD.

### Fixes
- **Release/Pages validation could skip heavy tests.** Under
`workflow_call` (release.yml, pages.yml) and `workflow_dispatch`, Detect
changes diffed `HEAD~1`; a docs-only last commit set `code=false` and
the release was validated without integration and browser tests. Only a
`pull_request` may now skip them.
- **Docs-only regex.** `^(docs/|\.md$|...)` anchored `\.md$` to the path
start, so no `*.md` outside docs/ ever counted as docs. Now
`^docs/|\.(md|txt)$|^LICENSE$|^\.github/ISSUE_TEMPLATE/`.
- `${{ }}` values in `run:` scripts go through `env:`.
- The Bun/Node/herdr setup duplicated across 7 jobs is one composite
action (`.github/actions/setup-ci`); the Bun version is set once
(pages.yml and release.yml pinned it separately).

### Self-hosted runner (opt-in, default unchanged)
- Repository variable `CI_SELF_HOSTED_LABELS` (JSON array containing
`"self-hosted"`) routes Fast checks, Integration tests, both Browser
regression jobs, Pages build/deploy and Release preflight/publish. Unset
= `ubuntu-24.04` as today. ci.yml also takes a `self_hosted_labels`
dispatch input for one manual run.
- Fork PRs always get `ubuntu-24.04` (`scripts/ci-runner-route.sh`,
tested in `scripts/ci-runner-route.test.ts`). Since a fork PR can edit
`runs-on` itself, REVIEW.md now says not to approve such runs.
- `scripts/self-hosted-runner/`: an ephemeral Docker runner (one job per
container, `--cap-drop ALL`, `no-new-privileges`, no sudo, no host
mounts, registration token on stdin) with Chromium libraries and ffmpeg
baked in. The browser lane skips its sudo `install-deps` when
`RUNNER_ENVIRONMENT=self-hosted`.
- Note: GitHub-hosted minutes are free for this public repository, so
the gain is speed (a 32-core host vs 4-core runners), not cost.

## Validation
- `bun run check fast`: workflow syntax, generated types, typecheck,
build, unit (2952 pass, 0 fail).
- Route script cases (fork PR, variable, dispatch override, malformed
labels) in `scripts/ci-runner-route.test.ts`.
- Runner image: uid 1001, no sudo, Chromium launches without root under
`--cap-drop ALL`; token absent from `/proc/1/environ`.
- A workflow_dispatch run of this branch on the self-hosted runner: see
the comment below.