feat(ci): automate GitHub Actions runner updates

[Nickfost]

Behavior

Adds a weekly and manually dispatched updater for the latest stable actions/runner release. It keeps these values synchronized in one deterministic update PR:

• runner/Dockerfile RUNNER_VERSION
• runner/Dockerfile x64 and arm64 SHA-256 pins
• deploy/compose.yaml CI_FLEET_RUNNER_VERSION default

The updater no-ops when all four pins already match. Scheduled runs reuse automation/update-actions-runner and refresh its existing PR.

Security controls

• Rejects drafts, prereleases, malformed tags, ambiguous assets, bad URLs, size mismatches, malformed archives, duplicate fields, mismatched current versions, and downgrades.
• Downloads both official Linux archives from derived GitHub URLs and calculates SHA-256 locally.
• Validates all four replacements in memory before writing and limits generated diffs to the two pin files.
• Uses explicit write permissions, a full-SHA checkout pin, persist-credentials: false, and force-with-lease.
• Dispatches the existing validation workflow on the generated branch because events created by GITHUB_TOKEN do not recursively start workflows.

Verification

• python3 scripts/test_update_actions_runner.py - 14 tests passed.
• python3 scripts/update_actions_runner.py - selected stable 2.337.0, downloaded and validated both official archives, and reported already current.
• Python compile, workflow run-block shellcheck, repository shellcheck, documentation links, diff checks, and committed-secret scan passed.
• Full local scripts/validate.sh reached 195 of 196 Docker-network-policy tests; its non-root temp-path test cannot traverse Hermes current $TMPDIR under /root. Later host-installer validation hit its existing outer deadline, and this host has no Docker CLI. The exact-head GitHub validation check remains the acceptance result.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.