fix(ci): run required checks on hosted runners

[br4vesirrobin]

Summary

• remove the self-hosted-first jobs that can remain queued indefinitely and prevent the supposed hosted fallback from starting
• run lint, pre-commit, unit-test matrix, and smoke checks directly on GitHub-hosted runners
• preserve the existing commands and Python matrix
• restrict workflow token permissions to read-only contents and disable persisted checkout credentials

Why

The existing fallback topology depends on the self-hosted job completing before the hosted job can start. With no eligible runner online, all required checks remain pending instead of falling back. This is not a functional fallback and blocks merge-on-all-green.

Validation

• actionlint .github/workflows/*.yml
• git diff --check