fix: hide JIT token from workflow processes

[everettVT]

What changed

Remove the repository-administration GITHUB_TOKEN from the job environment before starting Docker, minting the one-use JIT configuration, or replacing the entrypoint with the Actions runner. Add regression coverage and document the resulting trust boundary.

Dogfood also found and fixed two runner compatibility defects:

• use literal job keys in unique runs-on labels because github.job is empty during scheduling
• make the Ubuntu runner image executable by installing Python and make; configure Archetype to use it for actions/setup-python compatibility

Why

Archetype will use this fork for an advisory nightly runner benchmark. Validator and test processes must receive only the ordinary job-scoped Actions token, never the token capable of creating repository JIT runners.

Validation

• uv run --frozen pytest tests (55 passed)
• focused uv run --frozen ruff check
• uv run --frozen ruff format --check
• uv run --frozen ty check
• live one-use JIT runner jobs in https://github.com/VangelisTech/archetype/actions/runs/31619038210