CI: run on self-hosted arc-runner-set (org IP allow list blocks GitHub-hosted runners)

.github/workflows/ci.yml

@@ -12,13 +12,19 @@
 
 name: CI
 
+# Jobs run on the org's self-hosted "arc-runner-set" (enterprise
+# ge-aerospace-runner-group, Linux). GitHub-hosted runners are blocked by the
+# org IP allow list (hosted Azure runner IPs are not allow-listed -> checkout
+# 403), so ubuntu-latest cannot be used here. arc-runner-set checks out from an
+# internal allow-listed IP and, being Linux, still supports service containers.
+
 on:
   push:
   pull_request:
 
 jobs:
   backend:
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -29,13 +35,13 @@ jobs:
       - run: python -m pytest -q
 
   naming:
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     steps:
       - uses: actions/checkout@v4
       - run: bash scripts/check-naming-and-style.sh
 
   frontend:
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     defaults:
       run:
         working-directory: frontend
@@ -54,7 +60,7 @@ jobs:
     # ADR-013 Phase 5: prove a per-site build carries only its chosen plugins.
     # Builds a lean site (machines + printers) and asserts an omitted plugin's
     # code is absent from the bundle - the delete-a-plugin guarantee in CI.
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -92,7 +98,7 @@ jobs:
           echo "lean build verified: only chosen plugins present"
 
   migrations-mysql:
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     services:
       mysql:
         image: mysql:8.0