ci: route heavy workflows to self-hosted runners (Phase 2, fork-gated)

Reclaim GitHub-hosted machine-hours by routing the remaining heavy
workflows onto the self-hosted fleet proven out by #439, using the same
fork-gated runs-on expression (self-hosted for push/internal-branch PRs,
GitHub-hosted fallback for fork PRs).

- coin-matrix.yml  (coin smoke matrix) -> self-hosted Linux / ubuntu-24.04 fork fallback
- codeql-analysis.yml (Analyze legs)   -> self-hosted Linux / ubuntu-24.04 fork fallback
- attribution-gate.yml                 -> self-hosted Linux / ubuntu-latest fork fallback
- safe-cosmetic-automerge.yml (evaluate) -> self-hosted Linux / ubuntu-24.04 fork fallback

Build-env parity with build.yml on the two building jobs (coin-matrix,
codeql c-cpp manual): clean stale reused build dir on self-hosted
(rm -rf build_<coin> / build_codeql) to avoid stale gtest_discover
exit-8, and skip apt system-deps on self-hosted (preinstalled).

Per-coin source-presence guards (PR #47) untouched. CI plumbing only,
no consensus/coin-tree changes.

Author: frstrtr

.github/workflows/attribution-gate.yml

@@ -15,7 +15,7 @@ permissions:
 jobs:
   attribution-gate:
     name: attribution-gate
-    runs-on: ubuntu-latest
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted","Linux","X64","c2pool-build"]') || 'ubuntu-latest' }}
     steps:
       - name: Checkout full history
         uses: actions/checkout@v4

.github/workflows/codeql-analysis.yml

@@ -11,7 +11,7 @@ on:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-24.04
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted","Linux","X64","c2pool-build"]') || 'ubuntu-24.04' }}
     permissions:
       security-events: write
       packages: read
@@ -39,7 +39,7 @@ jobs:
           queries: security-and-quality
 
       # ── C++ build (manual mode only) ─────────────────────────────────────
-      - if: matrix.build-mode == 'manual'
+      - if: matrix.build-mode == 'manual' && runner.environment == 'github-hosted'
         name: Install system dependencies
         run: |
           sudo apt-get update -qq
@@ -71,6 +71,10 @@ jobs:
           key: conan2-ubuntu24-gcc13-${{ hashFiles('conanfile.txt') }}
           restore-keys: conan2-ubuntu24-gcc13-
 
+      - if: matrix.build-mode == 'manual' && runner.environment != 'github-hosted'
+        name: Clean stale build dir (self-hosted workspace is reused)
+        run: rm -rf build_codeql
+
       - if: matrix.build-mode == 'manual'
         name: Install Conan dependencies
         run: |

.github/workflows/coin-matrix.yml

@@ -20,7 +20,7 @@ on:
 jobs:
   coin:
     name: ${{ matrix.coin }} smoke (Linux x86_64)
-    runs-on: ubuntu-24.04
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted","Linux","X64","c2pool-build"]') || 'ubuntu-24.04' }}
     strategy:
       fail-fast: false
       matrix:
@@ -40,7 +40,7 @@ jobs:
           fi
 
       - name: Install system dependencies
-        if: steps.presence.outputs.exists == '1'
+        if: steps.presence.outputs.exists == '1' && runner.environment == 'github-hosted'
         run: |
           sudo apt-get update -qq
           sudo apt-get install -y --no-install-recommends \
@@ -70,6 +70,10 @@ jobs:
             conan2-ubuntu24-gcc13-${{ matrix.coin }}-
             conan2-ubuntu24-gcc13-
 
+      - name: Clean stale build dir (self-hosted workspace is reused)
+        if: steps.presence.outputs.exists == '1' && runner.environment != 'github-hosted'
+        run: rm -rf build_${{ matrix.coin }}
+
       - name: Conan install
         if: steps.presence.outputs.exists == '1'
         run: |

.github/workflows/safe-cosmetic-automerge.yml

@@ -51,7 +51,7 @@ concurrency:
 
 jobs:
   evaluate:
-    runs-on: ubuntu-24.04
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted","Linux","X64","c2pool-build"]') || 'ubuntu-24.04' }}
     steps:
       - name: Evaluate gate and merge if green and authorized
         env: