fix(ci): take the two hosted-runner builds off the PR rail (#11946, option 3)

.github/workflows/build.yml

@@ -1,9 +1,16 @@
 name: Build App
 
+# Manual-only since #11946. The hosted 7 GB runner can no longer build this tree — 19 of
+# the last 30 runs died with "The runner has received a shutdown signal" (VM out of
+# memory) ~8 min into `next build`, release/v3.8.51 itself included, even with the 10 GB
+# swapfile below. Triggered on `push: branches: ["**"]` it painted every branch and every
+# PR red while producing an artefact nothing downloads. The bundle is validated where a
+# build actually fits:
+#   - main:       ci.yml `Build` (self-hosted omni-build pool) on every merge
+#   - release/**: nightly-release-green.yml (same pool, continuous)
+# Dispatch this workflow by hand when a hosted build artefact is genuinely needed.
 on:
   workflow_dispatch:
-  push:
-    branches: ["**"]
 
 permissions:
   contents: read

.github/workflows/dast-smoke.yml

@@ -1,7 +1,15 @@
 name: DAST smoke (PR)
+# PRs into main only since #11946. The job's "Build CLI bundle" step is a backend-only
+# `next build`; on the hosted 7 GB runner it fits main's tree (~5.5 min) but dies on
+# release/v3.8.51 (VM shutdown ~7 min in, before the server even starts), and because the
+# job is continue-on-error the result was a permanently red advisory check on every
+# release PR — noise, not signal. DAST coverage for release/** lives on the nightly rail
+# (nightly-schemathesis.yml, nightly-llm-security.yml); dispatch this workflow by hand
+# to smoke a release branch on demand.
 on:
+  workflow_dispatch:
   pull_request:
-    branches: ["main", "release/**"]
+    branches: ["main"]
     # Runner-cost guard (#8084): the CLI-bundle build alone is 6-11min; a docs-only PR
     # cannot change DAST behavior, so skip the whole workflow for pure docs/markdown
     # changes. Any code path in the diff still runs the full smoke.

.github/workflows/quality.yml

@@ -61,6 +61,9 @@ jobs:
     name: Build (advisory)
     needs: changes
     # FORK PRs ONLY. build.yml's `Fast Production Build` triggers on `push: branches: ["**"]`
+    # (#11946, 2026-08-29: build.yml is now workflow_dispatch-only — the hosted runner cannot
+    # build this tree in any profile, 8/8 recent fork PRs included — so own-origin PRs rely on
+    # ci.yml `Build` after merge to main and on nightly-release-green for release/**.)
     # and runs `build:release` — a superset of this job — so for an own-origin branch this job
     # was building the same tree twice. A fork contributor pushes to THEIR repo, so that push
     # never fires here, and this is the only pre-merge build signal they get. Measured

changelog.d/maintenance/11946-hosted-build-rail.md

@@ -0,0 +1 @@
+- Take the two hosted-runner builds off the PR rail: `Build App` (`build.yml`) is `workflow_dispatch`-only and `DAST smoke (PR)` runs only for PRs into `main` — the 7 GB hosted VM cannot build `release/v3.8.51` in any profile (19/30 red, VM shutdown ~8 min into `next build`) and both checks had turned into permanent noise on every release PR; the bundle stays validated by `ci.yml` on `main` and by `nightly-release-green` on `release/**` (Closes #11946)