ci: exact-label runner allow-list, refuse unreadable runner forms (LAB-3500)

Kody flagged that the hosted-prefix pattern admitted a pool label renamed
`ubuntu-<anything>`. Allow-list the exact labels in use instead
(`^(ubuntu|macos|windows)-latest$`) — smaller than the prefix pattern and
not a second, staler copy of GitHub's image table (Kody's enumerated list
already omits ubuntu-26.04, macos-26-intel, windows-2025-vs2026, xcode-27).

Expert panel on the delta found four shapes that set a job's runner where
the guard could not read it and exited 0: flow-style `{runs-on: x}`, a
matrix built by `${{ fromJSON(...) }}` (the comment claimed "no fromJSON"
without enforcing it), a job calling a reusable workflow in another repo,
and quoted or upper-cased keys. Each is now an error, not a skip; keys and
values are lower-cased before matching. Rejected: banning
`continue-on-error` repo-wide (editing the guard job is deletion-class and
the ban has real cost) and YAML obfuscation forms (`? runs-on`, escapes) —
deliberate acts the guard is documented not to defend against; the
server-side control is LAB-1161 stage 2.

Verified with the job's exact program under mawk 1.3.4: clean tree exit 0;
42 fixtures (30 bad → ::error + exit 1, 12 good → exit 0); the pre-PR main
workflows fail on exactly their 19 `runs-on: cachekit` lines.

Author: 27Bslash6

.github/workflows/ci.yml

@@ -288,9 +288,13 @@ jobs:
   # GitHub-hosted runners — never on the org's self-hosted ARC pool (labels
   # `cachekit`, `cachekit-lean`). Allow-list, not deny-list: a deny-list fails
   # open on a new pool label, `CacheKit` casing, `${{ vars.X }}` indirection or
-  # the block form `runs-on: {group:, labels:}`. Every `runs-on:` and matrix
-  # `os:` value must be a hosted label or the literal `${{ matrix.os }}`, so a
-  # runner matrix has to spell its labels out inline (no fromJSON). This is
+  # the mapping form `runs-on: {group:, labels:}`. Every `runs-on:` and matrix
+  # `os:` value must be one of the exact labels in the allow-list regex below
+  # or the literal `${{ matrix.os }}`, written inline where the guard can read
+  # it: no fromJSON matrices, no flow-style `{runs-on: x}`, no reusable
+  # workflows from other repos (their runs-on lives outside this scan). Exact
+  # labels, not a hosted-prefix pattern: a prefix match would admit a pool
+  # label renamed `ubuntu-<anything>`. This is
   # drift protection for maintainers, NOT a fork-PR control: a fork PR runs the
   # fork's copy of this file and can simply delete the guard. The server-side
   # control is the runner group `cachekit-private` (allows_public_repositories
@@ -304,23 +308,33 @@ jobs:
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-    - name: Every runs-on / matrix os value is a GitHub-hosted label
+    - name: Every runs-on / matrix os value is an allow-listed GitHub-hosted label
       run: |
         # One awk pass, no shell pipeline: a program error exits non-zero and
         # fails the step (fail closed) instead of reading as "no match".
         # Comments are stripped before matching; `- os:` covers matrix include
         # entries. Same command runs locally: paste it from here.
         awk -f /dev/stdin .github/workflows/*.y*ml <<'AWK'
-          { sub(/#.*/, "") }
-          /^[[:space:]]*(-[[:space:]]*)?(runs-on|os)[[:space:]]*:/ {
+          { sub(/#.*/, ""); $0 = tolower($0) }
+          # A runner set where the rule below cannot read it is an error, not
+          # a skip: flow-style `{runs-on: x}` / `{os: [..]}`, a matrix built by
+          # an expression, or a job calling a reusable workflow in another repo.
+          /[{,][[:space:]]*["']?(runs-on|os)["']?[[:space:]]*:/ ||
+          /^[[:space:]]*(-[[:space:]]*)?(matrix|include|exclude)[[:space:]]*:[[:space:]]*\$\{\{/ ||
+          (/^[[:space:]]*uses[[:space:]]*:/ && /\/\.github\/workflows\// && !/uses[[:space:]]*:[[:space:]]*["']?\.\//) {
+            printf "::error file=%s,line=%d::runner set where the drift guard cannot read it — write `runs-on: <label>` / `os: [<labels>]` inline, spell matrices out (no fromJSON), call reusable workflows only from ./.github/workflows/ (LAB-3500)\n", FILENAME, FNR
+            bad = 1
+          }
+          /^[[:space:]]*(-[[:space:]]*)?["']?(runs-on|os)["']?[[:space:]]*:/ {
             v = $0; sub(/^[^:]*:[[:space:]]*/, "", v); sub(/[[:space:]]+$/, "", v)
             if (v ~ /^["']?\$\{\{[[:space:]]*matrix\.os[[:space:]]*\}\}["']?$/) next
+            if (v ~ /^\[/ && v !~ /\]$/) v = ""
             gsub(/[][ "']/, "", v)
             n = split(v, items, ",")
             ok = (n > 0)
-            for (i = 1; i <= n; i++) if (items[i] !~ /^(ubuntu|macos|windows)-[a-z0-9.-]+$/) ok = 0
+            for (i = 1; i <= n; i++) if (items[i] !~ /^(ubuntu|macos|windows)-latest$/) ok = 0
             if (!ok) {
-              printf "::error file=%s,line=%d::runner value \"%s\" is not a GitHub-hosted label — this public repo never runs on the self-hosted pool (LAB-1161)\n", FILENAME, FNR, (v == "" ? "<empty / block form>" : v)
+              printf "::error file=%s,line=%d::runner value \"%s\" is not an allow-listed GitHub-hosted label — this public repo never runs on the self-hosted pool (LAB-1161); adopting a new hosted image means extending the allow-list in this job\n", FILENAME, FNR, (v == "" ? "<value not inline on this line>" : v)
               bad = 1
             }
           }