ci: run on GitHub's hosted runners, as a public repository

[cristiangirlea]

Why

The repository is public. The owner's rule for public repositories (2026-10-13) is that CI runs on GitHub's hosted runners with no CI_RUNNER gate and no lab scale set: GitHub does not meter Actions minutes for public repositories, and a stranger's pull request must never reach the lab's self-hosted runners. PR #20 added the lab routing before that rule existed; this reverses it.

What changed

• .github/workflows/tests.yml, .github/workflows/model-smoke.yml: every job is runs-on: ubuntu-latest; the fork-gated vars.CI_RUNNER || 'ubuntu-latest' expressions and the lab-runner comments are gone; BENCH_RUNNER is the plain string GitHub-hosted ubuntu-latest.
• .github/actions/compose/ deleted and its uses: steps and path filter removed: GitHub's runner images ship the Docker Compose v2 plugin, so the pinned install only served the lab image.
• tests/python/test_workflows.py asserts the new shape and fails if a runs-on expression, a runner variable, a self-hosted label, a bare runner label or a local action under .github/actions comes back. It now collects *.yaml workflows as well as *.yml.
• README.md, docs/testing.md (CI runners), docs/security.md: CI runs on GitHub's hosted runners because the repository is public; the lab-runner sizing and the Compose install notes are gone. actions/checkout stays hash-pinned with persist-credentials: false.

Tests run

• docker compose -f docker/compose.yaml run --rm --no-deps python-tests: 127 tests OK (128 before: four compose-action tests removed, three runner-shape tests added).
• Red check on tests.yml: the new test fails for ${{ vars.CI_RUNNER || 'ubuntu-latest' }}, [self-hosted, linux], a bare lab-php-python-ai-bridge label and a reinserted compose action step, and passes unchanged.
• The PHP matrix, MCP, FrankenPHP integration and model smoke jobs run on this PR's checks; Real model smoke tests also gets a manual run on the branch.

Review

Independent review of d9ba43b. Blocking: the docs claimed that no self-hosted runner is registered for the repository and that no fork approval policy remains to keep, which only holds once the runner variable and the ARC scale set are removed outside this PR; fixed in bbbadba, which says no workflow names one and keeps the approval advice until none is registered. Non-blocking: the test did not collect *.yaml workflows (fixed in the same commit, the guard depends on it); the self-hosted regex and the ban on any .github/actions directory are broader than the rule (filed as an issue).

After the merge (owner's steps)

1. gh variable delete CI_RUNNER -R cristiangirlea/php-python-ai-bridge
2. In the infra repository, move php-python-ai-bridge from the runner repos (REPOS in config.mk, ci_runner_repos in tofu) to github_hosted_repos, as for harness (infra#57) and adanext-os (infra#61), in its own branch and PR.

Until step 2 is done, the fork approval setting for outside contributors stays as it is.