feat(ui): Centralized PMOVES UI with real-time health monitoring

.claude/learnings/pr366-self-hosted-runner-2025-12.md

@@ -27,3 +27,41 @@ This commit addresses CodeRabbit review feedback.
 2. **Git Submodules:** Use `git submodule add` CLI, never edit `.gitmodules` manually
 3. **Makefile `make -C`:** Never use `cd` in recipes when using `make -C <dir>`
 4. **Makefile Standards:** Include `all`, `test`, `clean` targets and `.DEFAULT_GOAL`
+
+## Runner Labels Reference
+
+| Runner Type | Label | Usage |
+|-------------|-------|-------|
+| CPU (VPS) | `[self-hosted, vps]` | General CI, Python tests, contract checks |
+| GPU (AI Lab) | `[self-hosted, ai-lab, gpu]` | ML models, CUDA workloads, TTS |
+
+## Pre-Merge Checklist
+
+- [x] All workflows have `permissions: contents: read`
+- [x] .gitmodules paths are correct
+- [x] Makefile test targets work with `make -C pmoves`
+- [x] Makefile has standard targets (all, test, clean)
+- [ ] CI passes on self-hosted runners
+- [ ] Smoke tests pass locally
+
+## Commands for Validation
+
+```bash
+# Validate workflow syntax
+actionlint .github/workflows/*.yml
+
+# Validate Makefile syntax
+make -n -C pmoves test-smoke
+
+# Verify submodule paths
+grep "^path=" .gitmodules | sort | uniq -d
+
+# Run pytest smoke tests
+cd pmoves && make test-smoke
+```
+
+## References
+
+- [GitHub Actions Security](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)
+- [POSIX Makefile Conventions](https://pubs.opengroup.org/onlinepubs/9699919799/utilities/make.html)
+- [Git Submodules](https://git-scm.com/docs/git-submodule)

.github/workflows/python-tests.yml

@@ -26,6 +26,9 @@ permissions:
   contents: read
 
 
+permissions:
+  contents: read
+
 permissions:
   contents: read
 

pmoves/Makefile

@@ -78,6 +78,7 @@ test: test-smoke ## Run pytest smoke tests
 
 .DEFAULT_GOAL := help
 
+# -------- Updates ----------
 .PHONY: update-service-docs
 update-service-docs: ## Regenerate service update notes from git metadata
 	@$(PYTHON) scripts/update_service_logs.py $(ARGS)