chore(ci): move workflows to DFW runners

[mattmattox]

Summary

• move all PR-validation and CI/CD jobs to the self-hosted-linux-dfw ARC scale set
• disable GitHub Actions dependency/build caches that are unsuitable for ephemeral self-hosted runners
• cap CI artifact retention at three days
• repair stale PR-validation database, coverage, permissions, and frontend artifact paths uncovered by the DFW canary
• isolate Go tests from Kubernetes service identity injected into runner pods

TaskForge: #20663 (kubetty-101)

Verification

• DFW PR-validation canary: https://github.com/SupportTools/KubeTTY/actions/runs/33050431612
• six jobs succeeded on concrete self-hosted-linux-dfw-* runners
• PostgreSQL 16 integration tests and all migrations passed; coverage 57.4% against the configured 35% threshold
• frontend: 138 tests passed and production build succeeded
• backend binaries built; Helm lint/template checks passed for gateway and project modes

Notes

• Existing unrelated Go 1.25, Dockerfile, module, and paste-image worktree changes were intentionally excluded.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:006e1bc41d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep untrusted PR jobs off self-hosted runners

When a pull request contains untrusted code, this workflow now checks it out and executes Go, npm, and database test commands on the DFW self-hosted infrastructure; the same regression exists in the pull_request path of pipeline.yml. A contributor can modify tests or package.json scripts to inspect the runner pod's credentials or reach services on its internal network, and ephemeral ARC runners only limit persistence after the job. Keep PR execution on GitHub-hosted runners or place it on a separately isolated runner group with no sensitive credentials or internal network access.

Useful? React with 👍 / 👎.