ci: use GitHub-hosted runners (org has no self-hosted runners registered)

.github/workflows/ci.yml

@@ -51,7 +51,7 @@ jobs:
   # -------------------------------------------------------------------------
   backend:
     name: Backend (pytest via docker compose)
-    runs-on: [self-hosted, linux, x64]
+    runs-on: ubuntu-latest
     timeout-minutes: 25
 
     steps:
@@ -214,7 +214,7 @@ jobs:
   # -------------------------------------------------------------------------
   bootstrap-failure:
     name: T2C bootstrap-failure smoke test
-    runs-on: [self-hosted, linux, x64]
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
@@ -323,7 +323,7 @@ jobs:
   # -------------------------------------------------------------------------
   frontend:
     name: Frontend (vitest + build)
-    runs-on: [self-hosted, linux, x64]
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     defaults:
       run:
@@ -364,16 +364,19 @@ jobs:
             exit 1
           fi
 
+      - name: Install Playwright Chromium
+        # `npm test` runs an inline Playwright spec (the skip-link regression
+        # guard), so the browser must be installed BEFORE the vitest step, not
+        # after it.
+        run: npx playwright install chromium
+
       - name: Run vitest suite
         # package.json "test" is already `vitest run`, so no -- --run needed.
         run: npm test
 
       - name: Production build
         run: npm run build
 
-      - name: Install Playwright Chromium
-        run: npx playwright install chromium
-
       - name: Accessibility gate (axe critical/serious)
         run: npm run a11y:ci
 
@@ -382,7 +385,7 @@ jobs:
 
   recovery-gates:
     name: Release recovery gates
-    runs-on: [self-hosted, linux, x64]
+    runs-on: ubuntu-latest
     timeout-minutes: 5
 
     steps:
@@ -413,7 +416,7 @@ jobs:
   # -------------------------------------------------------------------------
   ruff:
     name: ruff (lint)
-    runs-on: [self-hosted, linux, x64]
+    runs-on: ubuntu-latest
     timeout-minutes: 5
 
     steps:

.github/workflows/release-preflight.yml

@@ -38,7 +38,7 @@ on:
 
 jobs:
   preflight-release-provenance:
-    runs-on: [self-hosted, linux, x64]
+    runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:

.github/workflows/release.yml

@@ -119,7 +119,7 @@ jobs:
   preflight:
     name: Preflight release provenance fixtures
     if: github.event_name == 'push'
-    runs-on: [self-hosted, linux, x64]
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
         with:
@@ -146,7 +146,7 @@ jobs:
   verify-release-linux:
     name: Verify release on Linux (compose + tests)
     if: github.event_name == 'push'
-    runs-on: [self-hosted, linux, x64]
+    runs-on: ubuntu-latest
     needs: preflight
     steps:
       - uses: actions/checkout@v6
@@ -350,7 +350,7 @@ jobs:
     name: Create draft GitHub Release
     if: github.event_name == 'push'
     needs: [build-windows-installer]
-    runs-on: [self-hosted, linux, x64]
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
 
@@ -530,7 +530,7 @@ jobs:
     name: Publish GitHub Release
     if: github.event_name == 'push'
     needs: [release-cleanroom-rehearsal]
-    runs-on: [self-hosted, linux, x64]
+    runs-on: ubuntu-latest
     steps:
       - name: Publish release after cleanroom rehearsal
         env: