[Cross-Squad] Make generated workflow runners and checkout security configurable

[desharpe]

Source squad: desharpe/HealthAgent
Request type: cross-repository task delegation
Routing: Booster (CI/CD), with CONTROL/RETRO review
Related: #1493, #1462

Problem

@bradygaster/squad-cli and @bradygaster/squad-sdk currently emit GitHub Actions workflows with hardcoded hosted runners and mutable action tags. CLI upgrade also duplicates non-NPM workflow stubs, so repository-local template hardening is not preserved for standalone/global installs. This blocks downstream repositories that require organization-specific self-hosted runner labels and secure checkout defaults.

HealthAgent confirmed that patching installed package files from postinstall is not an acceptable fix: it is repository-specific, misses standalone/global CLI usage, and can generate the wrong ecosystem workflow.

Requested generic fix

• Add shared workflow-generation options supporting scalar or multi-label runs-on values without hardcoding a downstream repository's policy.
• Make secure checkout defaults explicit: immutable action references and persist-credentials: false.
• Consolidate CLI init/upgrade and non-NPM stubs on the shared generic renderer instead of duplicating workflow YAML generation.
• Expose equivalent runner/security options through the public SDK CI generator.
• Persist optional workflow-generation configuration in .squad/config.json so squad upgrade can reproduce the intended policy.
• Validate configured runner/action values and reject control characters or mutable action references where custom refs are accepted.
• Keep generated workflows ecosystem-aware for npm, .NET, Go, Python, Java, and unknown projects.

Acceptance criteria

1. Fresh init and upgrade from a globally installed CLI honor configured scalar and multi-label runners.
2. Public SDK generation produces the same runner and checkout-security behavior as the CLI.
3. Upgrade no longer replaces a configured self-hosted policy with ubuntu-latest.
4. Generated checkout steps use immutable pins and disable persisted credentials by default.
5. Generic ecosystem tests cover init, upgrade, standalone/global package behavior, and SDK generation.
6. CLI and SDK receive changesets and the fix is published on npm.

Downstream dependency: desharpe/HealthAgent#190. HealthAgent will remove its rejected local postinstall patch and upgrade to the published fixed packages before its runner-policy PR can merge.