fix(ci): pin Application CI hosted runner image

[seonghobae]

Root cause under investigation

Fresh exact-head evidence on the email-writing dependency root #1322 showed Application CI run 33518773598 stuck before checkout on both product jobs: backend job 99892417917 and frontend job 99892418052 remained queued with runner_id=0 and steps=[]. Protected develop@042b0c70531b229af3acbd0421a2f23098d848b3 selected the floating ubuntu-latest image for both jobs.

A central runner incident (ContextualWisdomLab/.github#712) had same-class observations suggesting explicit hosted-image selection was worth testing. This PR therefore isolates that hypothesis without weakening any gate.

TDD / experiment

RED commit 9db6eecdba1901683de26ca2cf31f7964a6bccda adds a repository-level regression requiring both Application CI jobs to use the explicit supported image. It fails against the protected-base workflow, which says ubuntu-latest.

Implementation commit df877204c1c9fa69153229c52976a9c3e7372129 changes only the two runs-on selectors to ubuntu-24.04.

Current exact-head evidence does not prove the hypothesis. Application CI run 33528210732 generated backend job 99924366568 and frontend job 99924367053 with labels exactly ["ubuntu-24.04"], but repeated live reads still show both queued, runner_id=0, steps=[], before checkout. This means explicit label selection alone is currently insufficient to restore runner acquisition in Naruon. The central owner path has been updated with this A/B evidence. Do not describe this PR as a successful runner repair unless actual acquisition/checkout evidence appears.

Writer/overlap boundary

External Claude-owned PR #1502 also edits .github/workflows/app-ci.yml, but its current patch does not change either runs-on selector; it adds PostgreSQL service/configuration and removes the PR branch filter. This PR intentionally excludes every #1502 behavior and carries only the runner-selection regression plus selector experiment. If #1502 merges first, ordinary-restack/reconcile this PR onto fresh protected develop, preserve only still-justified unique delta, and regenerate exact-head evidence. Do not copy or rewrite the external branch.

Acceptance / disposition

Keep this lane only while it supplies useful non-duplicative runner-selection evidence. It is mergeable only if:

• backend and frontend Application CI jobs actually acquire runners and reach checkout on this exact head;
• the regression remains justified by the observed root cause rather than merely encoding an unsuccessful experiment;
• all live required CI/security/dependency/coverage/package/SBOM/provenance/review/thread gates pass on one unchanged head;
• normal protected develop accepts a qualifying post-last-push approval, with no self-approval or bypass.

If central repair proves the selector change unnecessary or current evidence continues to show no causal benefit, close/supersede this experiment with its exact evidence rather than merging a speculative workflow preference.

Related: ContextualWisdomLab/.github#712.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.