ci: require static owned runner profiles

[shtse8]

Summary

• move build, lint, unit, and Kind e2e workflows from GitHub-hosted ubuntu-latest to the explicit sylphx-linux-standard profile
• add an executable guard that rejects GitHub-hosted, dynamic, generic self-hosted, legacy tuple, and invented product runner selectors
• run the guard in every workflow and classify workflow/guard changes as product-affecting, so this candidate executes the real controller test/build/e2e lanes instead of receiving a no-op skip

Runner selection

The current complete owned-runner inventory has live sylphx-linux-standard capacity; it is the documented baseline for tests, lint, controller builds, and general CI. No GitHub-hosted fallback or new runner profile is introduced.

Boundary

This is CI-compute routing and validation selection only. PR builds use push: false; no manual dispatch, artifact publication, deployment, retry, or cancellation is performed. After a normal admitted merge, the existing main build/publish behavior remains a separate post-merge evidence gate.

Validation

• bash .github/scripts/check-owned-runner-profiles.sh
• hosted and dynamic negative selector fixtures rejected
• candidate product selector reports product_changed=true
• shell syntax validation
• PyYAML parsed all workflow files
• git diff --check

go and actionlint are unavailable locally. Because the selector change forces product validation, the natural PR CI is the exact-candidate proof for Go, Docker build, and Kind e2e compatibility.

Work: wi_01KYFN6993PMG8WD00Q51AE231