ci: move all jobs off self-hosted uipath-ubuntu-latest to ubuntu-latest

The self-hosted `uipath-ubuntu-latest` pool is unavailable to this repo,
so every job pinned to it (Quality Gate, No-Extra Install, E2E Smoke,
CodeQL, docker-publish, publish-dev) sat queued indefinitely. Move them
all to GitHub-hosted `ubuntu-latest` so CI runs without depending on the
pool.

Note: this drops the self-hosted `SAFE_CHAIN_MINIMUM_PACKAGE_AGE`
supply-chain check on uv installs (a no-op on GitHub-hosted); the env is
kept so parity returns if a job ever moves back.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: uipreliga

.github/workflows/codeql.yml

@@ -16,7 +16,7 @@ permissions:
 jobs:
   analyze:
     name: Analyze Python code
-    runs-on: uipath-ubuntu-latest
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       security-events: write

.github/workflows/docker-publish.yml

@@ -41,7 +41,7 @@ env:
 jobs:
   publish:
     name: Build and push to GHCR
-    runs-on: uipath-ubuntu-latest
+    runs-on: ubuntu-latest
     # Skip semantic-release's own commit so we don't double-build on the
     # version-bump push.
     if: "!contains(github.event.head_commit.message, 'chore(release):')"

.github/workflows/pr-checks.yml

@@ -30,7 +30,7 @@ env:
 jobs:
   quality-gate:
     name: Quality Gate (Format, Lint, Type, Test, Security)
-    runs-on: uipath-ubuntu-latest
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     # Shared env for all steps: safe-chain min-age exclusions and a dummy
@@ -163,7 +163,7 @@ jobs:
     # registry validates, and the uipath-specific code paths fail with a
     # clear hint instead of an import error.
     name: No-Extra Install (uipath optional)
-    runs-on: uipath-ubuntu-latest
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Checkout code
@@ -326,7 +326,7 @@ jobs:
 
   e2e-smoke:
     name: E2E Smoke Tests (Real API)
-    runs-on: uipath-ubuntu-latest
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     # Skip on fork PRs where secrets aren't available
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository

.github/workflows/publish-dev.yml

@@ -28,7 +28,7 @@ permissions:
 jobs:
   publish-dev:
     name: Publish dev wheel for PR
-    runs-on: uipath-ubuntu-latest
+    runs-on: ubuntu-latest
     if: contains(github.event.pull_request.labels.*.name, 'build:dev')
     timeout-minutes: 15
     env: