Migrate CI to the public-repo posture (hosted-only, no governed selector)

[kyle-sexton]

Context

This repo is now deliberately public (owner-confirmed), but its CI still carries the private fleet-consumer posture: .github/runner-policy.json declares private + selfHostedCi: true, and every workflow consumes the governed local-runner selector. The runner-policy revision delivered by the standards sync (#345) enforces that public repos declare public, set selfHostedCi: false, and do not call the local-runner selector at all — so the sync PR and the merge queue behind it (#332, #344) are blocked until this migration lands.

Ask

1. .github/runner-policy.json: visibility: public, selfHostedCi: false.
2. Migrate all workflows off select-runner.yml to direct hosted runners (fleet policy already excludes public repos from self-hosted groups; live selection already routes hosted).
3. Land the parked queue in order: standards sync chore: sync standards components #345, gate pin bump ci: bump do-not-merge-gate pin to the gh-CLI-free revision #332, Dependabot comment fix build: fix the stale ci-workflows Dependabot ignore comment #344.

Related

• melodic-software/github-iac#169 — governance-side reconciliation (declaration, secret scanning, fleet-consumer removal)
• feat(runner-policy)!: remove the hosted-control-plane exception category standards#195 — the analyzer revision enforcing the public posture