fix(ci): migrate 3 monitoring crons to self-hosted runners (DAK-7665)

.github/workflows/ci.yml

@@ -17,12 +17,22 @@ permissions:
 jobs:
   validate:
     name: Validate Docker Configs
-    # GitHub-hosted: hadolint-action pulls ghcr.io/hadolint/hadolint which needs
-    # authenticated GHCR access; GitHub-hosted runners have ambient auth, self-hosted ARM do not.
-    runs-on: ubuntu-latest
+    # Self-hosted ARM64 (DAK-7665): explicit GHCR login before hadolint-action so
+    # the runner can pull ghcr.io/hadolint/hadolint without ambient GitHub auth.
+    runs-on: [self-hosted, linux, arm64]
+    permissions:
+      contents: read
+      packages: read
     steps:
       - uses: actions/checkout@v7
 
+      - name: Authenticate to GHCR (for hadolint image pull)
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Validate docker-compose.yml
         env:
           DAKERA_ROOT_API_KEY: ci-validation-placeholder

.github/workflows/hetzner-health-check.yml

@@ -21,7 +21,7 @@ env:
 jobs:
   health-check:
     name: Check Server Health
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, arm64]
     outputs:
       healthy: ${{ steps.final-status.outputs.healthy }}
     steps:
@@ -207,7 +207,7 @@ jobs:
 
   report-healthy:
     name: Log Healthy Status
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, arm64]
     needs: health-check
     if: needs.health-check.outputs.healthy == 'true'
     steps:

.github/workflows/playground-uptime-check.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   uptime-check:
     name: Check playground.dakera.ai health
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, arm64]
     timeout-minutes: 3
     steps:
       - name: Health check

.github/workflows/runner-wedged-watchdog.yml

@@ -1,8 +1,11 @@
 name: Wedged Runner Auto-Heal (DAK-7528)
 
 # Detects self-hosted runners that are busy=true with no active job (wedged state)
-# and auto-restarts them. Runs on GitHub-hosted ubuntu-latest so it works even when
-# all self-hosted runners are wedged.
+# and auto-restarts them. Runs on the x64 self-hosted runner (DAK-7665) so it
+# survives GitHub-hosted billing outages. Partial self-reference trade-off: if the
+# x64 runner itself is wedged, this job cannot run — but ARM is still monitored.
+# Full coverage requires an independent monitor; partial coverage beats zero during
+# a GitHub Actions billing lock.
 #
 # Wedged signature:
 #   - Runner shows busy=true in GitHub API
@@ -39,7 +42,7 @@ env:
 jobs:
   detect-and-heal:
     name: Detect + auto-heal wedged runners
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64]
     steps:
       - name: Check runner busy state and CI queue
         id: runner-check