.github/workflows: Migrate workflows to Blacksmith runners

.github/workflows/auto-fmt.yml

@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   auto-format:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ permissions:
 jobs:
   fmt:
     name: Check formatting
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -31,7 +31,7 @@ jobs:
   # API on stable (libFuzzer/nightly is only needed to actually *run* them).
   fuzz-check:
     name: Fuzz targets compile
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: fmt
     steps:
       - uses: actions/checkout@v4
@@ -50,7 +50,7 @@ jobs:
 
   clippy-and-test:
     name: Build, Test, Clippy
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: fmt
     # This job compiles the workspace three times (debug, release, and a third
     # release build for the panic=abort assert), runs the full workspace test
@@ -139,7 +139,7 @@ jobs:
     name: Integration Tests
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [blacksmith-4vcpu-ubuntu-2404, blacksmith-4vcpu-windows-2025]
     runs-on: ${{ matrix.os }}
     needs: fmt
     # The password-hashing tests exercise deliberately slow, memory/CPU-hard
@@ -240,7 +240,7 @@ jobs:
   # `cargo test`; this job exercises the env-gated PostgreSQL/MariaDB paths.
   database-tests:
     name: Database Tests (PostgreSQL + MariaDB)
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: fmt
     timeout-minutes: 15
     services:
@@ -291,7 +291,7 @@ jobs:
     name: Run WFL Programs
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [blacksmith-4vcpu-ubuntu-2404, blacksmith-4vcpu-windows-2025]
     runs-on: ${{ matrix.os }}
     needs: fmt
     timeout-minutes: 20
@@ -554,7 +554,7 @@ jobs:
   # so API drift that breaks the fuzz targets blocks the post-merge version bump.
   bump-version:
     name: Bump Version
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: [fmt, fuzz-check, clippy-and-test, integration-tests, database-tests, run-wfl-programs]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:

.github/workflows/claude-code-review.yml

@@ -18,7 +18,7 @@ jobs:
     #   github.event.pull_request.user.login == 'new-developer' ||
     #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
 
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: read
       pull-requests: read

.github/workflows/claude.yml

@@ -17,7 +17,7 @@ jobs:
       (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
       (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
       (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: read
       pull-requests: read

.github/workflows/nightly.yml

@@ -28,7 +28,7 @@ permissions:
 jobs:
   check-for-changes:
     name: Check for changes since last nightly build
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     outputs:
       should_build: ${{ steps.check.outputs.should_build }}
       version:      ${{ steps.version.outputs.version }}
@@ -122,7 +122,7 @@ jobs:
     name: Build WFL for Windows
     needs: check-for-changes
     if: needs.check-for-changes.outputs.should_build == 'true'
-    runs-on: windows-latest
+    runs-on: blacksmith-4vcpu-windows-2025
     # `cargo test --release` here compiles EVERY integration test binary in
     # tests/ (112 of them as of 26.7.49) against the full dependency graph, in
     # release mode with `[profile.release] debug = true` — so each one also links
@@ -440,7 +440,7 @@ jobs:
     name: Create or Update Nightly Release
     needs: [check-for-changes, build]
     if: needs.check-for-changes.outputs.should_build == 'true'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     permissions:
       contents: write

.github/workflows/update-security-doc.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   update-security:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: write
       pull-requests: write

.github/workflows/versioning.yml

@@ -5,7 +5,7 @@ on:
 
 jobs:
   bump-version:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: write
     steps:

.github/workflows/wfl-config-lint.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   config-lint:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
     - uses: actions/checkout@v4