ci: move workflows to self-hosted runners

.github/workflows/approve-maintainer-pr-workflow-runs.yaml

@@ -24,7 +24,7 @@ concurrency:
 jobs:
   approve:
     if: ${{ github.repository == 'NVIDIA/NemoClaw' }}
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 2
     steps:
       - name: Approve exact-head maintainer workflow runs

.github/workflows/assign-linked-issue-author.yaml

@@ -20,7 +20,7 @@ permissions:
 
 jobs:
   assign-linked-issue-author:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 10
     steps:
       - name: Assign linked issues to PR authors

.github/workflows/base-image.yaml

@@ -103,13 +103,13 @@ jobs:
           - agent: openclaw
             arch: amd64
             platform: linux/amd64
-            runner: ubuntu-24.04
+            runner: linux-amd64-cpu4
             dockerfile: Dockerfile.base
             image: nvidia/nemoclaw/sandbox-base
           - agent: openclaw
             arch: arm64
             platform: linux/arm64
-            runner: ubuntu-24.04-arm
+            runner: linux-arm64-cpu4
             dockerfile: Dockerfile.base
             image: nvidia/nemoclaw/sandbox-base
     steps:
@@ -222,14 +222,14 @@ jobs:
             display_name: Hermes
             arch: amd64
             platform: linux/amd64
-            runner: ubuntu-24.04
+            runner: linux-amd64-cpu4
             dockerfile: agents/hermes/Dockerfile.base
             image: nvidia/nemoclaw/hermes-sandbox-base
           - agent: hermes
             display_name: Hermes
             arch: arm64
             platform: linux/arm64
-            runner: ubuntu-24.04-arm
+            runner: linux-arm64-cpu4
             dockerfile: agents/hermes/Dockerfile.base
             image: nvidia/nemoclaw/hermes-sandbox-base
     steps:
@@ -335,14 +335,14 @@ jobs:
             display_name: Deep Agents Code
             arch: amd64
             platform: linux/amd64
-            runner: ubuntu-24.04
+            runner: linux-amd64-cpu4
             dockerfile: agents/langchain-deepagents-code/Dockerfile.base
             image: nvidia/nemoclaw/langchain-deepagents-code-sandbox-base
           - agent: langchain-deepagents-code
             display_name: Deep Agents Code
             arch: arm64
             platform: linux/arm64
-            runner: ubuntu-24.04-arm
+            runner: linux-arm64-cpu4
             dockerfile: agents/langchain-deepagents-code/Dockerfile.base
             image: nvidia/nemoclaw/langchain-deepagents-code-sandbox-base
     steps:
@@ -439,7 +439,7 @@ jobs:
     name: Build and push Hermes base image
     if: github.repository == 'NVIDIA/NemoClaw'
     needs: build-hermes-platforms
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -606,7 +606,7 @@ jobs:
     name: Build and push Deep Agents Code base image
     if: github.repository == 'NVIDIA/NemoClaw'
     needs: build-dcode-platforms
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -775,7 +775,7 @@ jobs:
     name: Build and push OpenClaw base image
     if: github.repository == 'NVIDIA/NemoClaw'
     needs: build-openclaw-platforms
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 10
     steps:
       - name: Checkout

.github/workflows/candidate-compatibility.yaml

@@ -31,7 +31,7 @@ concurrency:
 
 jobs:
   resolve:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 10
     outputs:
       matrix: ${{ steps.plan.outputs.matrix }}
@@ -109,7 +109,7 @@ jobs:
 
   deterministic:
     needs: resolve
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -248,7 +248,7 @@ jobs:
 
   live:
     needs: resolve
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 25
     steps:
       - name: Check out trusted compatibility controller
@@ -377,7 +377,7 @@ jobs:
       - resolve
       - deterministic
       - live
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 10
     permissions:
       actions: read

.github/workflows/cloudflared-update-check.yaml

@@ -18,7 +18,7 @@ concurrency:
 jobs:
   check-cloudflared:
     name: Check cloudflared release pin
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 10
     steps:
       - name: Checkout

.github/workflows/code-scanning.yaml

@@ -23,7 +23,7 @@ permissions:
 jobs:
   codeql:
     name: CodeQL (${{ matrix.language }})
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 15
     strategy:
       fail-fast: false
@@ -45,7 +45,7 @@ jobs:
 
   shellcheck:
     name: ShellCheck SARIF
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 10
     steps:
       - name: Checkout

.github/workflows/codebase-growth-guardrails.yaml

@@ -18,7 +18,7 @@ permissions:
 jobs:
   codebase-growth-guardrails:
     name: codebase-growth-guardrails
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 5
     steps:
       - name: Block newly added JavaScript files

.github/workflows/commit-lint.yaml

@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   commit-lint:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 5
     steps:
       - name: Checkout

.github/workflows/dco-check.yaml

@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   dco-check:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 5
     permissions:
       contents: read

.github/workflows/docker-pin-check.yaml

@@ -18,7 +18,7 @@ permissions:
 jobs:
   check-pin:
     if: github.repository == 'NVIDIA/NemoClaw'
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 5
     steps:
       - name: Checkout

.github/workflows/docs-cli-parity-pr.yaml

@@ -32,7 +32,7 @@ concurrency:
 
 jobs:
   cli-parity:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 10
     steps:
       - name: Checkout

.github/workflows/docs-links-pr.yaml

@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   markdown-links:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 5
     steps:
       - name: Checkout

.github/workflows/docs-preview-pr.yaml

@@ -30,7 +30,7 @@ env:
 
 jobs:
   preview:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 10
     steps:
       - name: Checkout repository

.github/workflows/docs-publish-public.yaml

@@ -20,7 +20,7 @@ env:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 15
     environment: docs-public
     steps:

.github/workflows/docs-publish-staging.yaml

@@ -27,7 +27,7 @@ env:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 15
     environment: docs-staging
     steps:
@@ -58,7 +58,7 @@ jobs:
           npx --yes "fern-api@${FERN_VERSION}" generate --docs --instance "$FERN_STAGING_INSTANCE"
 
   delete-preview:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     needs: publish
     timeout-minutes: 5
     permissions:

.github/workflows/docs-review-receipt.yaml

@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   docs-review-receipt:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 3
     steps:
       - name: Checkout

.github/workflows/e2e-main-retry.yaml

@@ -32,7 +32,7 @@ jobs:
     concurrency:
       group: e2e-main-retry-${{ github.event.workflow_run.id }}
       cancel-in-progress: false
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
     timeout-minutes: 10
     permissions:
       actions: write