.github/workflows: Migrate workflows to Blacksmith runners

[blacksmith-sh]

This PR has been automatically generated by a team member in your GitHub organization using Blacksmith's Migration Wizard. This PR changes the following:

1. Your selected workflows will now run on Blacksmith's 2x faster hardware (e.g., runs-on: blacksmith-4vcpu-ubuntu-2204). Learn more about the different instances available to choose from.
2. Your jobs running on Blacksmith will now have all official GitHub and popular third-party cache actions automatically interact with our 4x faster, colocated cache. Learn more about Blacksmith's actions cache.
3. Your GitHub Actions will now actually be observable. Learn more about Blacksmith's logging and other observability features.
4. Your Docker builds will now automatically share their Docker layer cache, resulting in up to 40x faster builds. Learn more about Blacksmith's Docker layer caching.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

[factory-droid]

Droid finished @blacksmith-sh[bot]'s task —— View job

---

Validated 2 candidate comments and approved both. Main risks are template downstream clones inheriting blacksmith-* runner tags without the Blacksmith app configured, plus ensuring org-level runner scope is properly restricted to prevent unintended cross-repo execution and billing exposure.

[factory-droid]

[P1] Document Blacksmith requirement for template clones

Because this repo is a template that gets cloned into downstream instances, switching runs-on to blacksmith-* can leave CI jobs queued (no matching runner) unless each clone installs/configures the Blacksmith GitHub App. Consider documenting that prerequisite clearly (or keeping a GitHub-hosted default runner and making Blacksmith opt-in) to avoid surprising broken CI in new clones.

[factory-droid]

[P1] [security] Confirm blacksmith-* runner scope and repo restrictions

If Blacksmith runners/labels are registered at the org level, any repository in the org could potentially target runs-on: blacksmith-* unless runner groups (or app installation scope) restrict which repos can use them. Please confirm these runners are limited to the intended repos to avoid unintended third-party code exposure and billing/DoS surprises for downstream clones.

[blacksmith-sh]

Blacksmith runners are not org-registered self-hosted runners: the blacksmith-* labels are only resolved for repositories covered by the Blacksmith GitHub App installation, whose repo scope and billing are controlled in the installation settings rather than in workflow files. Clones without the app simply queue with no matching runner, a prerequisite now documented in the README per the companion comment.

[factory-droid]

Droid finished @blacksmith-sh[bot]'s task —— View job

---

Validated 0 candidate review comments (0 approved, 0 rejected).

No new high-confidence issues found in this diff. Prior concerns about Blacksmith prerequisites for template clones and runner scope are already covered in existing PR comments and documentation updates.