CI blocked: needs GitHub Actions billing recovery (public repo — can't use self-hosted pool)

[marksverdhei]

Summary

This repo's CI is currently blocked and stays red until the org's GitHub-hosted Actions billing is restored. Filing as a tracking surface so the red runs aren't re-diagnosed as a new bug.

Why it's blocked both ways

• GitHub-hosted (ubuntu-latest): org Actions minutes are exhausted (since 2026-06-08); hosted runs fail at runner allocation.
• Self-hosted pool: this repo is public, and the org self-hosted runner groups run allows_public_repositories=false — GitHub's security default that stops public-repo fork-PRs from executing arbitrary code on our cluster (RCE protection). Public-repo jobs match the runner labels but are correctly never picked up.

There is no self-hosted path for a public repo; the fix is the org Actions billing bump. Enabling allows_public is not recommended (fork-PR-RCE risk not worth it).

What was tried

As part of the org CI self-hosted migration, the self-hosted flip was merged then reverted (#3 → revert #4) once the public-repo boundary was confirmed. This repo must stay on ubuntu-latest.

Refs

• Org CI migration + runner manifest: heiervang-technologies/cloud#146
• Permanent rule: visibility:public ⇒ keep-hosted
• Sibling public repos in the same state: am-i-openai-compatible, actions, unleash, assets

Filed by director-dev during the org CI self-hosted sweep; resolves when org Actions billing is restored.