ci: migrate GitHub Actions jobs to self-hosted Mac mini runners

[joeblau]

Summary

Migrate every first-party GitHub Actions job onto the self-hosted Apple Silicon Mac minis. Joe approved migrating everything.

runs-on: [self-hosted, macOS, ARM64]

Workflow scripts are BSD-portable (no apt, sudo, or GNU sed -i) and write scratch files under $RUNNER_TEMP. Playwright no longer uses --with-deps. Coverage generation and uploads are unchanged in scope (same file, --disable-search, fail on upload error).

Job-level env on these runners cannot use the runner context (${{ runner.temp }} does not parse). Every first-party job now exports TMPDIR=$RUNNER_TEMP via $GITHUB_ENV in a setup step. Workflows do not call replace().

Coverage now also runs on pull requests so the Mac mini coverage job is verified with the rest of CI (it still runs on main and workflow_dispatch).

Jobs migrated

Workflow	Job
code_quality.yml	quality
coverage.yml	coverage
docs.yml	docs
docs.yml	deploy
perf.yml	perf
publish_npm.yml	publish
tests_offline.yml	test
tests_online.yml	test

Not migrated

security.yml / osv-scan still calls google/osv-scanner-action reusable workflow. That callee pins runs-on: ubuntu-latest and a Linux container internally, so this repository cannot choose its runner.

The docs job no longer uses lycheeverse/lychee-action (Linux GNU binary + GNU install -t). It downloads the same lychee v0.24.2 aarch64-apple-darwin CLI into $RUNNER_TEMP, checksum-verifies it, and runs the same Markdown scan.

Coverage no longer uses codecov/codecov-action. That action requires host gpg, which is not on the Mac mini. The job pin-downloads Codecov CLI v11.3.1 codecovcli_macos (universal x86_64/arm64), SHA256-verifies it, and runs the same upload-coverage with --fail-on-error.

Jobs no longer use oven-sh/setup-bun. That action installs into ~/.bun, which is shared across runner instances on the same Mac mini. A parallel canary install overwrote Bun mid-job (1.4.4 → 1.4.0) and the perf gate refused the environment mismatch. Each job now downloads bun-darwin-aarch64 canary into $RUNNER_TEMP and links bunx next to bun (the zip ships only bun).

The perf job prunes leftover git worktrees before adding the base checkout. Self-hosted workspaces persist; a prior job can leave $RUNNER_TEMP/base registered after the directory is wiped.

Runner prerequisites

See docs/ci-runners.md. The Mac mini needs:

• GitHub Actions runner labeled self-hosted, macOS, ARM64
• Xcode Command Line Tools (git, clang)
• Stock macOS: curl, tar, unzip, sed, shasum, bash, tee

This repository's workflows do not require host gh, gtar, jq, or gpg. Publish reads the version with Bun; archives use stock tar; Codecov uses the pinned CLI above.

Host gap (sibling repos): the Mac mini has no gpg. Any workflow that still calls codecov/codecov-action without a pre-verified binary will fail until GnuPG is installed on PATH.

Workflows install Bun canary, Node.js 24 (publish only), Playwright Chromium, lychee, and the Codecov CLI themselves. Homebrew, Docker, apt, and sudo are not required.

CI may stay queued until a labeled runner picks the jobs up. Do not merge until that is confirmed.