ci(#17397): 4 agregateurs vers ubuntu-latest (Q35 etape 2)

.github/workflows/adjacency-stale-sweep.yml

@@ -67,11 +67,10 @@ concurrency:
 jobs:
   sweep:
     name: Refresh stale G-VAR-3 adjacency verdicts
-    # Routage tranche 4 (#14283, pool coursia-linux) : balayage cron horaire
-    # pur-Python -- déclencheurs schedule/workflow_dispatch uniquement, donc
-    # code repo-owned seul, aucune garde same-repo requise (cf. entêtes de
-    # check_self_hosted_runner_policy.py et stale-guard-red-sweep.yml).
-    runs-on: [self-hosted, coursia-ephemeral, coursia-linux]
+    # Q35 etape 2 (#17397) : balayage cron pur-Python, aucun secret ni
+    # toolchain locale -- routage #14283 inverse, retour sur ubuntu-latest
+    # et sortie de SELF_HOSTED_WORKFLOW_ALLOWLIST dans le meme commit.
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - name: Bootstrap gh into the persistent toolcache

.github/workflows/pr-gate-rerun.yml

@@ -76,11 +76,13 @@ concurrency:
 jobs:
   resolve:
     name: Resolve the re-aggregation route (manual)
-    # Route vers la jambe Linux auto-hebergee (#13378 tranche 5, decision ai-01
-    # 2026-09-02) : garde Python pur, sans secret. La garde same-repo ci-dessous
-    # saute les PRs de fork (pr_gate.py compte `skipped` comme OK) : aucun code de
-    # fork n'atteint le runner. Retour arriere = revert de la PR.
-    runs-on: [self-hosted, coursia-ephemeral, coursia-linux]
+    # Q35 etape 2 (#17397) : agregateur pur -- resolve/re-run du gate, aucun
+    # secret, docker, GPU ni toolchain locale. Re-agreger decide si une PR est
+    # mergeable : tant que ce travail tourne sur le parc local, il se degrade
+    # exactement quand la file qu'il doit debloquer grossit (saturation du
+    # 2026-09-22). La garde same-repo ci-dessous est conservee telle quelle --
+    # seul le runner change, aucune semantic de declenchement.
+    runs-on: ubuntu-latest
     if: github.event.pull_request.head.repo.full_name == null || github.event.pull_request.head.repo.full_name == github.repository
     outputs:
       action: ${{ steps.resolve.outputs.action }}
@@ -155,7 +157,8 @@ jobs:
     name: Re-run the original PR gate (manual)
     needs: resolve
     if: needs.resolve.outputs.action == 'rerun'
-    runs-on: [self-hosted, coursia-ephemeral, coursia-linux]
+    # Q35 etape 2 (#17397) : idem resolve -- agregateur pur, ubuntu-latest.
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Re-run the original run
@@ -175,7 +178,8 @@ jobs:
     name: Aggregate a gate-absent PR head (manual)
     needs: resolve
     if: needs.resolve.outputs.action == 'aggregate_absent'
-    runs-on: [self-hosted, coursia-ephemeral, coursia-linux]
+    # Q35 etape 2 (#17397) : idem resolve -- agregateur pur, ubuntu-latest.
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       # The aggregation script + the delivery canary both read the repo:

.github/workflows/pr-gate-sweep-health-advisory.yml

@@ -61,13 +61,10 @@ concurrency:
 jobs:
   health:
     name: PR gate sweep health advisory
-    # Routage #14283 tranche 4 (ai-01 2026-09-02) : balayage cron pur-Python.
-    # Declencheurs `schedule` + `push` sur main -- les deux ne portent que des
-    # refs du depot (SAFE_SELF_HOSTED_TRIGGERS), donc aucun code de fork ne peut
-    # l'atteindre et aucune garde same-repo n'est requise (cf en-tete de
-    # check_self_hosted_runner_policy.py). Retour arriere = remettre
-    # `runs-on: ubuntu-latest` + retrait de l'allowlist.
-    runs-on: [self-hosted, coursia-ephemeral, coursia-linux]
+    # Q35 etape 2 (#17397) : balayage cron pur-Python, aucun secret ni
+    # toolchain locale -- routage #14283 inverse, retour sur ubuntu-latest
+    # et sortie de SELF_HOSTED_WORKFLOW_ALLOWLIST dans le meme commit.
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4

.github/workflows/stale-guard-red-sweep.yml

@@ -59,12 +59,10 @@ concurrency:
 jobs:
   sweep:
     name: Signal PRs blocked on a pre-fix red
-    # Routage #14283 tranche 4 (ai-01 2026-09-02) : balayage cron pur-Python.
-    # Declencheur `schedule` uniquement -- il ne tourne que sur la branche par
-    # defaut, donc aucun code de fork ne peut l'atteindre et aucune garde
-    # same-repo n'est requise (cf en-tete de check_self_hosted_runner_policy.py).
-    # Retour arriere = remettre `runs-on: ubuntu-latest` + retrait de l'allowlist.
-    runs-on: [self-hosted, coursia-ephemeral, coursia-linux]
+    # Q35 etape 2 (#17397) : balayage cron pur-Python, aucun secret ni
+    # toolchain locale -- routage #14283 inverse, retour sur ubuntu-latest
+    # et sortie de SELF_HOSTED_WORKFLOW_ALLOWLIST dans le meme commit.
+    runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@v4

scripts/ci/check_self_hosted_runner_policy.py

@@ -168,7 +168,6 @@
     #   Aucun trigger pull_request -> aucune garde same-repo requise (tranche
     #   4 #14283, meme profil que pr-gate-stale-sweep). Rollback = revert de
     #   la PR (l'entree disparait de l'allowlist).
-    "adjacency-stale-sweep.yml",
     "ascii-flowchart-advisory.yml",
     "candidate-delivered-advisory.yml",
     "catalog-cron.yml",
@@ -208,7 +207,6 @@
     # repliee comme etape du sweep ci-dessous (design-gate ai-01 : "meme
     # population, meme requete ; seule la branche de remediation differe.
     # Ne pas creer un troisieme organe").
-    "pr-gate-sweep-health-advisory.yml",
     "pr-path-collision-advisory.yml",
     # queue-ghost-watch.yml (#14367, owner myia-po-2023:CoursIA-2) : sonde cron
     #   04:17 UTC (offset anti-stampede, hors-:00) sur les 18 zombies QUEUED
@@ -227,7 +225,6 @@
     "review-coverage-advisory.yml",
     "slides-build-advisory.yml",
     "slow-lane.yml",
-    "stale-guard-red-sweep.yml",
     "translation-parity.yml",
     "twin-parity-cron.yml",
     "twin-parity-drift-audit.yml",
@@ -305,7 +302,6 @@
     "notebook-validation.yml",
     "owui-playwright-check.yml",
     "perimeter-review-guard.yml",
-    "pr-gate-rerun.yml",
     "regression-guard.yml",
     "render-volume-delta-advisory.yml",
     # registre TRANCHE7 (demande user 2026-09-05, owner myia-po-2023:CoursIA)