The org IP allow list blocks GitHub-hosted runner IPs (checkout 403), so point all jobs at the self-hosted arc-runner-set. Drop the rsync dependency in build-site.sh (cp + bytecode prune; the ARC runner image has no rsync) and remove the migrations-mysql job - ARC/Kubernetes has no service containers, so that MySQL 8 coverage stays on the internal CI.