ci: migrate all workflows to arc-villager self-hosted runners (#68)

• ci: migrate all workflows from ubuntu-latest to arc-villager

self-hosted runner scale set arc-villager backs builds with java 21

• dind on the cluster's gemini node. covers test, pr-build, publish (both jobs), claude, and close-default-branch-prs.

publish.yml's publish job was previously pinned to ubuntu-24.04; that distinction goes away on arc since the runner image is fixed.

before merging confirm Settings → Actions → 'Approval for first-time contributors' is set so fork PRs can't auto-trigger jobs on the self-hosted runner.

• ci: address copilot security review on PR #68

• test.yml + pr-build.yml: conditional runs-on so fork PRs fall back to ubuntu-latest. arc-villager only runs trusted gradle builds.
• close-default-branch-prs.yml: revert to ubuntu-latest. it's a pull_request_target workflow that any fork PR can trigger; pure github API calls, zero need for self-hosted, all DoS surface.
• claude.yml: gate on github.actor == github.repository_owner so only the repo owner can spend the CLAUDE_CODE_OAUTH_TOKEN secret via @claude mentions.

co-authored-by: copilot-pull-request-reviewer copilot-pull-request-reviewer@users.noreply.github.com

Co-authored-by: Matt Artist claude@mart.fyi Co-authored-by: copilot-pull-request-reviewer copilot-pull-request-reviewer@users.noreply.github.com