Move workflows onto the ARC runner sets; smoke suites go dual-arch

All jobs leave GitHub-hosted runners. Static checks and the GoReleaser
job run on arc-amd64-runners (CGO is off, so one machine cross-compiles
every release target). The two smoke suites matrix across
arc-amd64-runners and arc-arm64-runners with fail-fast off — they boot
the whole compose stack, so they now prove the platform images work on
both architectures. .github/actionlint.yaml declares the custom labels
so actionlint keeps passing.

Assumes the ARC scale sets provide Docker (dind mode) for the compose
jobs.

Claude-Session: https://claude.ai/code/session_01Ltxzv9Jhowy5FUFn7hTMwD

Author: vtomasr5

.github/actionlint.yaml

@@ -0,0 +1,6 @@
+# Tells actionlint about our self-hosted (ARC) runner scale sets, so it
+# doesn't flag runs-on values it can't know about.
+self-hosted-runner:
+  labels:
+    - arc-amd64-runners
+    - arc-arm64-runners

.github/workflows/ci.yml

@@ -15,8 +15,9 @@ permissions:
   contents: read
 
 jobs:
+  # Arch-agnostic static checks: one runner is enough.
   checks:
-    runs-on: ubuntu-latest
+    runs-on: arc-amd64-runners
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
@@ -32,8 +33,15 @@ jobs:
             exit 1
           fi
 
+  # The smoke suites test the containerized platform itself, so they run on
+  # both architectures — the compose stack has to work on amd64 and arm64
+  # (Graviton) nodes alike.
   smoke-open:
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [arc-amd64-runners, arc-arm64-runners]
+    runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
@@ -46,7 +54,11 @@ jobs:
         run: docker compose logs --tail 200
 
   smoke-auth:
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [arc-amd64-runners, arc-arm64-runners]
+    runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7

.github/workflows/release.yml

@@ -14,7 +14,9 @@ permissions:
 
 jobs:
   goreleaser:
-    runs-on: ubuntu-latest
+    # GoReleaser cross-compiles every target (CGO is off), so one amd64
+    # runner builds the linux amd64/arm64 and darwin arm64 binaries alike.
+    runs-on: arc-amd64-runners
     steps:
       - uses: actions/checkout@v7
         with: