fix(ci): pin GitHub-hosted Ubuntu runner image

[seonghobae]

Superseded prerequisite — keep Draft until successor verification

This runner-image prerequisite is now fully carried by the sole same-path writer, PR #159. Do not merge this branch independently.

PR #159 exact 8dc374ed597292a9d97a25e7cdea832b5990b6dd non-force adopted every unique #153 source/test delta:

• .github/workflows/ci.yml: explicit ubuntu-24.04;
• .github/workflows/fuzz.yml: explicit ubuntu-24.04;
• .github/workflows/scorecard-analysis.yml: explicit ubuntu-24.04;
• tests/workflow_runner_contract.rs: permanent rejection of floating ubuntu-latest and enumeration of every runner-backed local workflow.

The successor also owns the compatible queue-pressure repair on the same CI/Fuzz paths: PR-number-scoped cancellation only for superseded PR heads, unique non-PR concurrency groups, and one-runner sequential bounded fuzz. Keeping this branch Ready would violate the single-writer/foundation ordering rule.

This PR remains open/Draft rather than closed until #159's exact current successor passes its own current-head gates and the complete delta is revalidated. #153's repository CI/Fuzz/Security/SAST successes on exact b663f9d200e5f385c7dd067d074940a02836c68e remain historical evidence that the explicit ubuntu-24.04 prerequisite is executable; they do not transfer as #159 merge evidence.

The latest #159 exact runner-acquisition specimen is handed to .github#712; no selector downgrade, no-op redispatch, self/model approval, routine bypass, force push, or gate weakening is authorized.

[coderabbitai]

Warning

Review limit reached

Next included review available in 56 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 93bc1b74-0e30-408f-999a-adfedce5c88e

📥 Commits

Reviewing files that changed from the base of the PR and between cc15cc2 and b663f9d.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• .github/workflows/fuzz.yml
• .github/workflows/scorecard-analysis.yml
• tests/workflow_runner_contract.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

현재 #159 head 8dc374ed597292a9d97a25e7cdea832b5990b6dd가 이 PR의 runner 고정 delta를 완전히 승계했습니다. scorecard workflow와 tests/workflow_runner_contract.rs blob은 동일하고, CI/Fuzz는 ubuntu-24.04를 그대로 보존한 채 같은-PR concurrency와 4→1 Fuzz job 축소만 추가합니다. #159 exact head에서 workspace 157 tests, fmt, clippy -D warnings, 전체 local workflow actionlint, diff-check가 통과했습니다. force push나 predecessor check 전용은 사용하지 않았으며 중복 PR 방지를 위해 이 predecessor를 닫습니다.