ci: use hosted checks for public pull requests

[MarcoPorcellato]

Summary

• Replace this public repository's ordinary per-PR receipt gate with standard GitHub-hosted Rust CI.
• Run the complete deterministic suite on Linux and macOS; compile every test target without execution on Windows while native Windows runtime/cache qualification remains pending.
• Document why public hosted runners provide no billable saving when replaced locally.
• Publish measured private-repository case studies for Matryca-Knowledge and the approved public alias Matryca-Brain, with machine-readable inputs and recomputed arithmetic.

Trust claim checklist

• Public claims do not relabel compile-only or contract evidence as native execution.
• The hosted workflow uses pinned checkout code, read-only permissions, exact PR-head checkout, and no secrets, cache actions, Docker, self-hosted runner, or CCP execution.
• Windows runtime/cache behavior remains explicitly pending; the qualified native Windows benchmark is a narrower claim.
• Runtime, receipt, schema, policy, dependency, secret, and product behavior are unchanged.

Validation notes

Exact head: ada1901b082efcda6d5a18f63d856d3885f7189b

• TDD runner-context regression: RED with runner.temp at job scope, GREEN after resolving it inside the test step.
• TDD platform-boundary regression: RED with Windows in the runtime-test matrix, GREEN with a separate compile-only lane.
• Local verification: formatting, Clippy with denied warnings, documentation with denied warnings, release metadata, and git diff --check passed.
• Local deterministic suite: 456 passed, 4 ignored across 26 suites.
• Independent Luna review: READY, no findings.
• Hosted run 33290506580: quality, Ubuntu full suite, macOS full suite, Windows test-target compilation, and aggregate hosted gate all SUCCESS.
• The earlier exact-head Windows execution at 6f58869... compiled successfully, then reported 167 passed and 83 failed across still-unqualified lock/path/runtime tests; this evidence is preserved and not reinterpreted as runtime qualification.
• Historical receipt gate inherited from main: expected bootstrap blocker until the public-repository ruleset transition is separately approved.
• CCP run, Docker workload, evidence publication, merge, cleanup, stable installation, tag, and release: NOT RUN.

Impact and rollback

• Ordinary public pull requests use free standard hosted runners rather than maintainer Mac resources.
• CCP receipts remain an optional product capability and historical exact-commit evidence.
• Rollback is a normal revert of these commits; restoring a mandatory receipt gate would require a separately reviewed economic or non-economic justification.