fix(workflows): match runner label — runs-on ubuntu-latest, not self-hosted

Closes #508.

Our gitea-runner advertises labels ubuntu-latest / ubuntu-24.04 /
ubuntu-22.04. `runs-on: self-hosted` never matches → dispatched
deploy jobs sit in the queue forever. The runner is still
genuinely self-hosted (DooD socket, joined to gitea_gitea net,
single-tenant per ADR-011) — the `self-hosted` token was just an
unconfirmed assumption about the label name.

Unblocks #497 / #499 first deploy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/nightly.yml

@@ -43,7 +43,13 @@ env:
 
 jobs:
   deploy-staging:
-    runs-on: self-hosted
+    # `ubuntu-latest` matches our self-hosted runner's advertised label
+    # (the runner has labels: ubuntu-latest / ubuntu-24.04 / ubuntu-22.04).
+    # `self-hosted` would never match — no runner advertises it — so the
+    # job parks in the queue forever. ADR-011's "single-tenant" promise
+    # is at the repo level; sharing this runner between CI and deploys
+    # for the same repo is within that boundary.
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 

.gitea/workflows/release.yml

@@ -45,7 +45,9 @@ env:
 
 jobs:
   deploy-production:
-    runs-on: self-hosted
+    # See nightly.yml — same rationale: `ubuntu-latest` matches the
+    # advertised label of our single-tenant self-hosted runner.
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4