Promote graceful scale-in for actions-runner to global modules

[akuzminsky]

Summary

• Promotes the graceful scale-in implementation from environments/sandbox/modules/profile/github_runner/ to the top-level modules/profile/github_runner/ (follow-up to Graceful scale-in for actions-runner (development) #265 dev, Promote graceful scale-in for actions-runner to sandbox #268 sandbox).
• Copies the 9 files listed in Promote graceful scale-in (actions-runner) to global modules #267: 4 new (gha-lifecycle-heartbeater.sh, gha-lifecycle-heartbeater.timer, gha-on-runner-exit.sh, gha-lifecycle-heartbeater.service.erb) and 5 updated (gha_prerun.sh, register.pp, service.pp, actions-runner.service.erb, start-actions-runner.sh.erb).
• After merge, modules/profile/github_runner/ is byte-identical to the sandbox copy; production and other environments without overrides pick it up.

Closes #267.

Deployment strategy

Same gradual, Puppet-first approach used for sandbox in #268:

1. Merge + deploy this PR to production runners.
2. Observe old-Terraform / new-Puppet behavior in prod: characterize delete_registration_token under old IAM and the missing-fact path for deregistration_hookname.
3. Then roll out terraform-aws-actions-runner Part 1 (new fact + IAM) to remaining production AWS accounts.
4. Validate the full happy path across production.

Note: the environment-specific copies in environments/development/ and environments/sandbox/ are deliberately kept for now so their bake periods remain pinned to the version they were validated on. Cleanup of those overrides is out of scope for this PR.

Test plan

Phase 1 — old-Terraform / new-Puppet (this PR)

• puppet-lint --fail-on-warnings clean on global profile module (done locally).
• Heartbeater service/timer come up on production runners without crashing.
• delete_registration_token behavior under old IAM characterized — fails loudly but runner still terminates cleanly.
• Runs with deregistration_hookname fact absent do not cause fatal errors in Puppet or lifecycle scripts.
• No stuck Terminating:Wait instances beyond heartbeat_timeout that would not also have been stuck pre-change.

Phase 2 — after Terraform Part 1 is applied to all production accounts

• No ValidationError on SetInstanceProtection in CloudTrail during production scale-in events.
• No stuck Terminating:Wait instances beyond heartbeat_timeout.
• delete_registration_token succeeds (no AccessDeniedException).
• Full success criteria in .claude/plans/actions-runner-scale-in-race.md verified across production runners.

🤖 Generated with Claude Code