[askalf]

What

Moves these jobs from GitHub-hosted runners to the repository's own runners (browser-bridge-exec):

• fleet-review-relay.yml: relay
• fuzz.yml: fuzz
• pr-triage.yml: triage

Each job uses the same runs-on expression as this repository's other self-hosted jobs:

• A job triggered by a pull request from a fork, or by a Dependabot pull request, still runs on ubuntu-latest.
• A job that runs only on a schedule, a push or a dispatch runs on ubuntu-latest in a fork of this repository.

Untrusted code never reaches the self-hosted runners.

Staying on GitHub-hosted runners

• build.yml, cflite.yml, stealth.yml: they build or run Docker images, and these runners have no Docker socket.
• release.yml, fieldpass-publish.yml: npm trusted publishing (OIDC) needs a GitHub-hosted runner.
• codeql.yml: CodeQL sizes itself to the machine; concurrent analyses on one shared host would exhaust its memory.
• scorecard.yml: Scorecard only publishes results from GitHub-hosted runners.

[sprayberry-redline]

Verdict: approve. The runner expressions keep fork and Dependabot pull requests on GitHub-hosted runners while routing eligible jobs to the repository runners. The relay and triage steps do not execute pull request code, and the fuzz job retains its repository guard and hosted fallback for external pull requests.