Use GitHub-hosted runners for Odoo reusable workflows

[cbusillo]

Summary

• Move Odoo reusable API workflows to ubuntu-latest so tenant repositories without Launchplane self-hosted runners can call them.
• Keep privileged provider mutations inside the deployed Launchplane service boundary; reusable jobs only call public GitHub/Launchplane endpoints with OIDC.
• Add workflow contract coverage and update operations/product repo docs.

Verification

• uv run python -m unittest tests.test_product_onboarding
• git diff --check
• Claude/Gemini review completed. Caveat noted: artifact publish may lose self-hosted Docker layer cache, but correctness is unaffected.

Investigation context

• cm-website post-deploy run 27146398756 queued because cbusillo/odoo-tenant-cm-website has 0 self-hosted runners while Launchplane runners are repo-local to cbusillo/launchplane.