Add isolated ephemeral execution for heavy validation

[litroc]

Goal

Add an opt-in heavy-validation workflow for tests that exceed the capabilities of standard GitHub-hosted runners while keeping the public workflow, tested revision, and results transparent.

Requirements

• Standard validation continues to run on GitHub-hosted runners.
• Heavy validation is never triggered by pull_request or pull_request_target.
• Only a protected workflow revision from the default branch may request heavy validation.
• The tested source revision is identified by and verified against a full commit SHA.
• Third-party actions are pinned to immutable commit SHAs.
• Each heavy-validation job uses a fresh ephemeral worker that accepts one job only.
• Job permissions follow least privilege and do not expose production secrets.
• Worker cleanup is mandatory and blocks subsequent execution when it fails.
• Public results include the tested commit, workflow revision, outcome, and sufficient provenance for reproduction.

Acceptance criteria

• A documented manual or post-merge trigger exists.
• Pull requests and forks cannot allocate the private execution capacity.
• Mutable or invalid source references are rejected.
• One fresh worker is used per job and removed afterward.
• Least-privilege permissions are enforced.
• Cleanup failure is visible and prevents further scheduling.
• Positive and negative acceptance tests are automated.
• Public documentation explains the trust boundary without publishing internal infrastructure details.

Implementation-specific infrastructure, network, monitoring, and security evidence is tracked in the internal Jira task linked in a follow-up comment.